CVE-2014-1909 Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negat...
HighCVSS 7.5
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negative length value, which bypasses a signed comparison and triggers a stack-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/android-platform-system-core(Debian:11) | < 1:6.0.0+r26-1~stage1 | 1:6.0.0+r26-1~stage1 |
| Google android debug bridge | All versions | No fix listed |
| Google android sdk platform tools | = 18.0.1 | No fix listed |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
References
- security-tracker.debian.org vendor-advisory
- openSUSE-SU-2014:0636 vendor-advisory
- openSUSE-SU-2014:0637 vendor-advisory
- [oss-security] 20140208 Re: CVE Request: Multiple security issues in Android Debug Bridge (Android SDK Tools) mailing-list
- 65403 exploit vdb-entry
- androidsdk-cve20141909-bo(91291) vdb-entry