CVE-2011-3874: Buffer Overflow

Published Jan 27, 2012

Updated

Stack-based buffer overflow in libsysutils in Android 2.2.x through 2.2.2 and 2.3.x through 2.3.6 allows user-assisted remote attackers to execute arbitrary code via an application that calls the FrameworkListener::dispatchCommand method with the wrong number of arguments, as demonstrated by zergRush to trigger a use-after-free error.

Affected Software

12 affected components

Google Android=2.2

Google Android=2.2-rev1

Google Android=2.2.1

Google Android=2.2.2

Google Android=2.3

Google Android=2.3-rev1

Google Android=2.3.1

Google Android=2.3.2

Google Android=2.3.3

Google Android=2.3.4

Google Android=2.3.5

Google Android=2.3.6

Remediation

Patch Available

http://code.google.com/p/android/issues/detail?id=21681

Event History

Jan 27, 2012

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-3874?

CVE-2011-3874 is classified as a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary code.

How do I fix CVE-2011-3874?

The best fix for CVE-2011-3874 is to upgrade your Android version to a secure release that addresses this buffer overflow issue.

What systems are affected by CVE-2011-3874?

CVE-2011-3874 impacts Android versions 2.2.x to 2.3.6.

What type of vulnerability is CVE-2011-3874?

CVE-2011-3874 is a stack-based buffer overflow vulnerability that can be exploited through certain application commands.

Can CVE-2011-3874 be exploited without user interaction?

CVE-2011-3874 typically requires user-assisted interaction to exploit, such as running a malicious application.