Researchers at the Open Source Computer Emergency Response Team (oCERT) disclosed two denial-of-service vulnerabilities in Google Inc.'s Android 1.5 mobile phone platform, both of which have already been patched by the vendor.
One of the vulnerabilities stems from Android's handling of SMS messages, according to an advisory released by oCERT earlier this week. The flaw allows an attacker to use malformed WAP (Wireless Application Protocol) Push messages to disconnect a mobile phone from a cellular network. WAP Push messages are typically used to send ringtones, wallpapers and other content to mobile users.
According to oCERT, a maliciously crafted WAP message can cause the phone to reboot without the user's knowledge, which can lead to a temporary loss of connectivity and dropped calls. In cases where the phone's SIM (subscriber identity module) is protected by a PIN, users will need to re-enter the PIN to re-establish connectivity, causing longer delays. When the bug is triggered repeatedly, it could result in a denial-of-service condition, oCERT said.
More: http://computerworld.com/s/article/9139192/
One of the vulnerabilities stems from Android's handling of SMS messages, according to an advisory released by oCERT earlier this week. The flaw allows an attacker to use malformed WAP (Wireless Application Protocol) Push messages to disconnect a mobile phone from a cellular network. WAP Push messages are typically used to send ringtones, wallpapers and other content to mobile users.
According to oCERT, a maliciously crafted WAP message can cause the phone to reboot without the user's knowledge, which can lead to a temporary loss of connectivity and dropped calls. In cases where the phone's SIM (subscriber identity module) is protected by a PIN, users will need to re-enter the PIN to re-establish connectivity, causing longer delays. When the bug is triggered repeatedly, it could result in a denial-of-service condition, oCERT said.
More: http://computerworld.com/s/article/9139192/