Featured Video, News

Microsoft to build duo of UAE data centres

0 89Microsoft has announced plans to build its first Middle East and North Africa data centres in Dubai and Abu Dhabi.
Don't show me again

Google patches DoS vulnerabilities in Android

Researchers at the Open Source Computer Emergency Response Team (oCERT) disclosed two denial-of-service vulnerabilities in Google Inc.'s Android 1.5 mobile phone platform, both of which have already been patched by the vendor.

One of the vulnerabilities stems from Android's handling of SMS messages, according to an advisory released by oCERT earlier this week. The flaw allows an attacker to use malformed WAP (Wireless Application Protocol) Push messages to disconnect a mobile phone from a cellular network. WAP Push messages are typically used to send ringtones, wallpapers and other content to mobile users.

According to oCERT, a maliciously crafted WAP message can cause the phone to reboot without the user's knowledge, which can lead to a temporary loss of connectivity and dropped calls. In cases where the phone's SIM (subscriber identity module) is protected by a PIN, users will need to re-enter the PIN to re-establish connectivity, causing longer delays. When the bug is triggered repeatedly, it could result in a denial-of-service condition, oCERT said.

A similar vulnerability was discovered in several Sony Ericsson handsets earlier this year. In that case, a malformed WAP Push message could be used to remotely reboot a vulnerable handset.

The other DoS vulnerability was reported in the API for Android's Dalvik virtual machine. It also allows an attacker to create a DoS condition by causing a handset to repeatedly reboot without the user's knowledge.

The advisories were released this week after Google issued patches addressing both problems.

Previous ArticleNext Article

Leave a Reply

Your email address will not be published. Required fields are marked *


The free newsletter covering the top industry headlines