CVE-2015-3858: Critical severity Google Android vulnerability
The checkDestination function in internal/telephony/SMSDispatcher.java in Android before 5.1.1 LMY48M relies on an obsolete permission name for an authorization check, which allows attackers to bypass an intended user-confirmation requirement for SMS short-code messaging via a crafted application, aka internal bug 22314646.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Androidto a version that resolves this vulnerability.Fixed in 5.1.1 LMY48M
Event History
Frequently Asked Questions
Who is exposed to this issue?
Devices running Android versions before 5.1.1 build LMY48M are affected. The issue is in the Android telephony SMS dispatcher.
What does an attacker need to exploit it?
An attacker needs to get a crafted application onto the device. The vulnerability can then be used to bypass the intended user-confirmation requirement for SMS messages sent to short codes.
What is the potential impact of successful exploitation?
A successful attacker can send SMS short-code messages without the intended user confirmation. The reported severity vector indicates potential impact to confidentiality, integrity, and availability.
How can this be remediated?
Update Android to 5.1.1 build LMY48M or a later version containing the fix. The vulnerable authorization check relies on an obsolete permission name.