Google Android Picasa encryption Vulnerability

Release date:

Last Updated:

Hazard level: critical

Vulnerability Type: Encryption

Threat Type: Remote

Android is a project launched by Google through Open Handset Alliance. It is used to provide a complete set of software for mobile devices, including operating systems and middleware.

Android Picasa in Android 3.0 and 2.3.4 and 2.x use Plaintext HTTP sessions when transmitting authtokens obtained from ClientLogin. Remote attackers can use a link with picasaweb.google.com to sniff tokens to gain privileges and access private images and web Albums.

Currently, the vendor has released an upgrade patch to fix this security issue. Obtain the patch link:

Http://android.git.kernel.org /? P = platform/packages/apps/Gallery3D. git; a = tree; h = 9c0b71c0f29922a4c2ea67eee553e6aae7a1c9f6; hb = platform

Source: www.uni-ulm.de

Link: http://www.uni-ulm.de/en/in/mi/staff/koenings/catching-authtokens.html

Source: android.git.kernel.org

Link: http://android.git.kernel.org /? P = platform/packages/apps/Gallery3D. git; a = commit; h = 9a418de454e5ce078c98f41b5c18e3bb9175bd20

Source: android.git.kernel.org

Link: http://android.git.kernel.org /? P = platform/packages/apps/Gallery3D. git; a = commit; h = 7a763db1c15bb6436be85a3f23382e%1970b6e