Google Android SDK Hits Security Speed Bump

Google’s Android software development kit is using several outdated and vulnerable open-source image processing libraries, according to an alert from Core Security, a company that specializes in penetration-testing software.
In an advisory released Mar. 4, Core Security identified several exploitable heap overflows and integer overflows haunting Android, Google’s software stack for mobile devices that includes an operating system, middleware and key applications.
In all, Core Security lists eight different vulnerabilities identified in the Android SDK, which is currently in beta.
On the Android Developers Blog, developer advocate Jason Chen confirmed “a security issue involving handling of image files” that has been fixed with the latest with the recently updated Android m5-rc15.
Although the Android project is currently in a development phase and has not yet made an official release, Core Security noted that several mobile chip vendors have released prototype phones built with early releases of Android.
“Several vulnerabilities have been found in Android’s core libraries for processing graphic content in some of the most used image formats (PNG, GIF an BMP). While some of these vulnerabilities stem from the use of outdated and vulnerable open-source image processing libraries other were introduced by native Android code that use them or that implements new functionality,” Core Security warned.
The company has released proof-of-concept code to show that the vulnerabilities can be exploited to take “complete control” of a phone running the Android platform.
The proof-of-concept has been used successfully on the emulator included in the SDK, proving the possibility of running code on Android stack (over an ARM architecture) via a binary exploit.
Core Security said Android SDK m3-rc37a and earlier are vulnerable to several bugs in components that process GIF, PNG and BMP images, and Android SDK m5-rc14 is vulnerable to a security bug in the component that process BMP images.
In a Vendor Statement section of the advisory, the Google-backed Open Handset Alliance says there will be many changes and updates to the platform before Android is ready for users. These changes are expected to include full security review.