Mailing-List: contact dev-help@cordova.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cordova.apache.org
Received-SPF: pass (athena.apache.org: domain of cmarcelk@gmail.com designates
 209.85.216.171 as permitted sender)
From: Marcel Kinard <cmarcelk@gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Date: Mon, 11 Aug 2014 18:09:59 -0400
Subject: Apache Cordova 3.5.1: CVE-2014-3502 update
To: dev@cordova.apache.org,
 security@apache.org,
 oss-security@lists.openwall.com,
 bugtraq@securityfocus.com
Message-Id: <69AEC4CC-A12D-459C-8FDF-E5072D9E10DC@gmail.com>
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))

The following text is amended from the original that was sent on August =
4th. More background information on this amendment can be found at =
http://cordova.apache.org/announcements/2014/08/06/android-351-update.html=


Android Platform Release: 04 Aug 2014

CVE-2014-3502: Cordova apps can potentially leak data to other apps via =
URL
loading


Severity: Medium

Vendor:
The Apache Software Foundation

Versions Affected:
Cordova Android versions up to 3.5.0

Description:
Android applications built with the Cordova framework can launch other
applications through the use of anchor tags, or by redirecting the =
webview to
an Android intent URL. An attacker who can manipulate the HTML content =
of a
Cordova application can create links which open other applications and =
send
arbitrary data to those applications. An attacker who can run arbitrary
JavaScript code within the context of the Cordova application can also =
set the
document location to such a URL. By using this in concert with a second,
vulnerable application, an attacker might be able to use this method to =
send
data from the Cordova application to the network.

The latest release of Cordova Android takes steps to block explicit =
Android
intent urls, so that they can no longer be used to start arbitrary =
applications
on the device.

Implicit intents, including URLs with schemes such as "tel", "geo", and =
"sms"
can still be used to open external applications by default, but this =
behaviour
can be overridden by plugins.

Upgrade path:
Developers who are concerned about this should rebuild their =
applications with
Cordova Android 3.5.1.

Credit:
This issue was discovered by David Kaplan and Roee Hay of IBM Security =
Systems.=