News for hackers. Stuff that matters.

A comment on Major Android Bug Is a Privacy Disaster (CVE-2014-6041).

Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by slingerofwheat on Monday September 15, 2014 @07:28PM (#8322173)
Is anyone familiar with the code that allows this vulnerability to be present and where I can find it(I believe this project is open source)? I understand the exploit is adding a nullbyte at the beginning of some javascript due to some bad handling in the parsing code. So I'm looking here: https://android.googlesource.com/platform/packages/apps/Brow...
[ Parent | on HN ]
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by joev_ on Monday September 15, 2014 @08:34PM (#8322427)
I don't know the exact location, but it is probably somewhere in the webview tree, since it affects apps that embed webviews as well:

https://android.googlesource.com/platform/frameworks/base/+/...

[ Parent | on HN ]
Re:Major Android Bug Is a Privacy Disaster (CVE-2014-6041) by smtddr on Monday September 15, 2014 @09:51PM (#8322643)
Since it's both webview and browser itself, I'd suspect some kind of common denominator object at fault... like...https://android.googlesource.com/platform/frameworks/base/+/...

Especially with a method called "public static class IllegalCharacterValueSanitizer".

[ Parent | on HN ]