Android 4.4 is PATCHED but earlier versions still vulnerable

IBM researchers have discovered a critical security vulnerability in Android 4.3 (Jelly Bean) and below which could allow attackers to exfiltrate sensitive information – credentials, private keys – from vulnerable devices. The vulnerability is found in Android’s secure storage service KeyStore, and can be misused to cause a stack-based buffer overflow, which would then allow malicious code to be executed under the keystore process. The vulnerability was discovered last September, and immediately disclosed to the Android Security Team. A patch for the flaw was included in the new Android version (4.4 – KitKat) a few months later. <more>