Mailing-List: contact dev-help@cordova.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cordova.apache.org
MIME-Version: 1.0
Date: Fri, 20 Nov 2015 11:39:56 -0800
Message-ID: 
 <CAOBL_k7wfgXxa946QuVcyPk9J5LoOgFNNhQZVXY9YRoQi_0J=g@mail.gmail.com>
Subject: CVE-2015-5257 - Weak Randomization of BridgeSecret for Apache Cordova
 Android
From: Joe Bowser <bowserj@gmail.com>
To: DAVIDKA@il.ibm.com, Roee Hay <ROEEH@il.ibm.com>,
	"private@cordova.apache.org" <private@cordova.apache.org>,
 dev <dev@cordova.apache.org>,
	"security@apache.org" <security@apache.org>, oss-security@lists.openwall.com,
	bugtraq@securityfocus.com
Content-Type: multipart/alternative; boundary=001a113f8d1e525c5a0524fe0a53

--001a113f8d1e525c5a0524fe0a53
Content-Type: text/plain; charset=UTF-8

===================================================================
CVE-2015-5257: Weak Randomization of BridgeSecret for Apache Cordova Android

Severity: Low

Vendor:
The Apache Software Foundation

Versions Affected:
Cordova Android versions up to and including 3.6.4

Description:

Cordova uses a bridge that allows the Native Application to communicate
with the HTML and Javascript that control the user interface.  To protect
this bridge on Android, the
framework uses a BridgeSecret to protect it from third-party hijacking.
However, the BridgeSecret is not sufficiently random and can be determined
in certain scenarios.

Upgrade Path:
Developers who are concerned about this issue should rebuild their
applications with Cordova Android 4.1.1 or later.  Version 3.7.1 and later
do not contain this vulnerability.

Credit: David Kaplan & Roee Hay, IBM X-Force Application Security Research
Team.

--001a113f8d1e525c5a0524fe0a53--