Google ha proporcionado hoy información sobre los parches de seguridad de Android aplicados bajo la actualización correspondiente de marzo de 2017 disponible para socios, manufactureros y desarrolladores de su plataforma móvil.
Los parches conectan un número significativo de huecos de seguridad que amenazan a todos los dispositivos Android y afortunadamente, Google encontró decenas de vulnerabilidades, de las que clasificó a 10 como crítico, o capaz de ejecutar código remotamente.
Google está lanzando dos parches para cubrir estas vulnerabilidades, una con fecha 1 de marzo y la segunda con fecha de 5 de marzo y las siguientes son las que la gigante de Internet enlista
1 de marzo
| Issue | CVE | Severity | Affects Google devices? |
|---|---|---|---|
| Remote code execution vulnerability in OpenSSL & BoringSSL | CVE-2016-2182 | Critical | Yes |
| Remote code execution vulnerability in Mediaserver | CVE-2017-0466, CVE-2017-0467, CVE-2017-0468, CVE-2017-0469, CVE-2017-0470, CVE-2017-0471, CVE-2017-0472, CVE-2017-0473, CVE-2017-0474 | Critical | Yes |
| Elevation of privilege vulnerability in recovery verifier | CVE-2017-0475 | Critical | Yes |
| Remote code execution vulnerability in AOSP Messaging | CVE-2017-0476 | High | Yes |
| Remote code execution vulnerability in libgdx | CVE-2017-0477 | High | Yes |
| Remote code execution vulnerability in Framesequence library | CVE-2017-0478 | High | Yes |
| Elevation of privilege vulnerability in Audioserver | CVE-2017-0479, CVE-2017-0480 | High | Yes |
| Elevation of privilege vulnerability in NFC | CVE-2017-0481 | High | Yes |
| Denial of service vulnerability in Mediaserver | CVE-2017-0482, CVE-2017-0483, CVE-2017-0484, CVE-2017-0485, CVE-2017-0486, CVE-2017-0487, CVE-2017-0488 | High | Yes |
| Update: Denial of service vulnerability in Mediaserver | CVE-2017-0390 | High | Yes |
| Update: Denial of service vulnerability in Mediaserver | CVE-2017-0392 | High | Yes |
| Elevation of privilege vulnerability in Location Manager | CVE-2017-0489 | Moderate | Yes |
| Elevation of privilege vulnerability in Wi-Fi | CVE-2017-0490 | Moderate | Yes |
| Elevation of privilege vulnerability in Package Manager | CVE-2017-0491 | Moderate | Yes |
| Elevation of privilege vulnerability in System UI | CVE-2017-0492 | Moderate | Yes |
| Information disclosure vulnerability in AOSP Messaging | CVE-2017-0494 | Moderate | Yes |
| Information disclosure vulnerability in Mediaserver | CVE-2017-0495 | Moderate | Yes |
| Denial of service vulnerability in Setup Wizard | CVE-2017-0496 | Moderate | Yes |
| Denial of service vulnerability in Mediaserver | CVE-2017-0497 | Moderate | Yes |
| Denial of service vulnerability in Setup Wizard | CVE-2017-0498 | Moderate | No* |
| Denial of service vulnerability in Audioserver | CVE-2017-0499 | Low | Yes |
5 de marzo
| Issue | CVE | Severity | Affects Google devices? |
|---|---|---|---|
| Elevation of privilege vulnerability in MediaTek components | CVE-2017-0500, CVE-2017-0501, CVE-2017-0502, CVE-2017-0503, CVE-2017-0504, CVE-2017-0505, CVE-2017-0506 | Critical | No* |
| Elevation of privilege vulnerability in NVIDIA GPU driver | CVE-2017-0337, CVE-2017-0338, CVE-2017-0333, CVE-2017-0306, CVE-2017-0335 | Critical | Yes |
| Elevation of privilege vulnerability in kernel ION subsystem | CVE-2017-0507, CVE-2017-0508 | Critical | Yes |
| Elevation of privilege vulnerability in Broadcom Wi-Fi driver | CVE-2017-0509 | Critical | No* |
| Elevation of privilege vulnerability in kernel FIQ debugger | CVE-2017-0510 | Critical | Yes |
| Elevation of privilege vulnerability in Qualcomm GPU driver | CVE-2016-8479 | Critical | Yes |
| Elevation of privilege vulnerability in kernel networking subsystem | CVE-2016-9806, CVE-2016-10200 | Critical | Yes |
| Vulnerabilities in Qualcomm components | CVE-2016-8484, CVE-2016-8485, CVE-2016-8486, CVE-2016-8487, CVE-2016-8488 | Critical | No* |
| Elevation of privilege vulnerability in kernel networking subsystem | CVE-2016-8655, CVE-2016-9793 | High | Yes |
| Elevation of privilege vulnerability in Qualcomm input hardware driver | CVE-2017-0516 | High | Yes |
| Elevation of privilege vulnerability in MediaTek Hardware Sensor Driver | CVE-2017-0517 | High | No* |
| Elevation of privilege vulnerability in Qualcomm ADSPRPC driver | CVE-2017-0457 | High | Yes |
| Elevation of privilege vulnerability in Qualcomm fingerprint sensor driver | CVE-2017-0518, CVE-2017-0519 | High | Yes |
| Elevation of privilege vulnerability in Qualcomm crypto engine driver | CVE-2017-0520 | High | Yes |
| Elevation of privilege vulnerability in Qualcomm camera driver | CVE-2017-0458, CVE-2017-0521 | High | Yes |
| Elevation of privilege vulnerability in MediaTek APK | CVE-2017-0522 | High | No* |
| Elevation of privilege vulnerability in Qualcomm Wi-Fi driver | CVE-2017-0464, CVE-2017-0453, CVE-2017-0523 | High | Yes |
| Elevation of privilege vulnerability in Synaptics touchscreen driver | CVE-2017-0524 | High | Yes |
| Elevation of privilege vulnerability in Qualcomm IPA driver | CVE-2017-0456, CVE-2017-0525 | High | Yes |
| Elevation of privilege vulnerability in HTC Sensor Hub Driver | CVE-2017-0526, CVE-2017-0527 | High | Yes |
| Elevation of privilege vulnerability in NVIDIA GPU driver | CVE-2017-0307 | High | No* |
| Elevation of privilege vulnerability in Qualcomm networking driver | CVE-2017-0463, CVE-2017-0460 | High | Yes |
| Elevation of privilege vulnerability in kernel security subsystem | CVE-2017-0528 | High | Yes |
| Elevation of privilege vulnerability in Qualcomm SPCom driver | CVE-2016-5856, CVE-2016-5857 | High | No* |
| Information disclosure vulnerability in kernel networking subsystem | CVE-2014-8709 | High | Yes |
| Information disclosure vulnerability in MediaTek driver | CVE-2017-0529 | High | No* |
| Information disclosure vulnerability in Qualcomm bootloader | CVE-2017-0455 | High | Yes |
| Information disclosure vulnerability in Qualcomm power driver | CVE-2016-8483 | High | Yes |
| Information disclosure vulnerability in NVIDIA GPU driver | CVE-2017-0334, CVE-2017-0336 | High | Yes |
| Denial of service vulnerability in kernel cryptographic subsystem | CVE-2016-8650 | High | Yes |
| Elevation of privilege vulnerability in Qualcomm camera driver (device specific) | CVE-2016-8417 | Moderate | Yes |
| Information disclosure vulnerability in Qualcomm Wi-Fi driver | CVE-2017-0461, CVE-2017-0459, CVE-2017-0531 | Moderate | Yes |
| Information disclosure vulnerability in MediaTek video codec driver | CVE-2017-0532 | Moderate | No* |
| Information disclosure vulnerability in Qualcomm video driver | CVE-2017-0533, CVE-2017-0534, CVE-2016-8416, CVE-2016-8478 | Moderate | Yes |
| Information disclosure vulnerability in Qualcomm camera driver | CVE-2016-8413, CVE-2016-8477 | Moderate | Yes |
| Information disclosure vulnerability in HTC sound codec driver | CVE-2017-0535 | Moderate | Yes |
| Information disclosure vulnerability in Synaptics touchscreen driver | CVE-2017-0536 | Moderate | Yes |
| Information disclosure vulnerability in kernel USB gadget driver | CVE-2017-0537 | Moderate | Yes |
| Information disclosure vulnerability in Qualcomm camera driver | CVE-2017-0452 | Low | Yes |
Como siempre, las mejoras van directamente a los dispositivos de marca Nexus y Pixel con imágenes en los repositorios y actualización en OTA y recibirán los dos parches en una sola descarga.
La empresa afirmó que hasta donde tienen conocimiento, las fallas de seguridad descubiertas en Android, no han sido explotadas en la calle, así que asegúrate de actualizarte y mientras, equipos de otras marcas, quedará de sus manufactureros ponerse pie con bola.
