<--

PJSIP PJSUA2 Android SDK Deserialization Code Execution

Aleph Research Advisory

Identifier

CVE-2015-2003

Severity

High

Product

PJSIP PJSUA2

Vulnerable Version

Before SVN Changeset 5132

Mitigation

Use SVN Changeset 51322 or later.

Technical Details

The PJSIP PJSUA2 SDK for Android contains a Serializable class, with a ‘finalize’ method that later calls a native function with an attacker-controllabe pointer, eventually allowing for code execution by malicious apps.

Timeline

Credit

External References

  1. "One Class to Rule Them All" (USENIX WOOT '15)
  2. RSA USA '16
  3. RSA APAC '16
  4. OWASP AppSec IL '15