Bugtraq mailing list archives
Fwd: CVE-2015-5257 - Weak Randomization of BridgeSecret for Apache Cordova Android
From: Shazron <shazron () apache org>
Date: Fri, 20 Nov 2015 11:46:54 -0800
---------- Forwarded message ---------- From: Joe Bowser <bowserj () gmail com> Date: Fri, Nov 20, 2015 at 11:39 AM Subject: CVE-2015-5257 - Weak Randomization of BridgeSecret for Apache Cordova Android To: DAVIDKA () il ibm com, Roee Hay <ROEEH () il ibm com>, "private () cordova apache org" <private () cordova apache org>, dev <dev () cordova apache org>, "security () apache org" <security () apache org>, oss-security () lists openwall com, bugtraq () securityfocus com =================================================================== CVE-2015-5257: Weak Randomization of BridgeSecret for Apache Cordova Android Severity: Low Vendor: The Apache Software Foundation Versions Affected: Cordova Android versions up to and including 3.6.4 Description: Cordova uses a bridge that allows the Native Application to communicate with the HTML and Javascript that control the user interface. To protect this bridge on Android, the framework uses a BridgeSecret to protect it from third-party hijacking. However, the BridgeSecret is not sufficiently random and can be determined in certain scenarios. Upgrade Path: Developers who are concerned about this issue should rebuild their applications with Cordova Android 4.1.1 or later. Version 3.7.1 and later do not contain this vulnerability. Credit: David Kaplan & Roee Hay, IBM X-Force Application Security Research Team.
Current thread:
- Fwd: CVE-2015-5257 - Weak Randomization of BridgeSecret for Apache Cordova Android Shazron (Nov 21)