CVE-2014-3100

EUVD-2014-3121
Stack-based buffer overflow in the encode_key function in /system/bin/keystore in the KeyStore service in Android 4.3 allows attackers to execute arbitrary code, and consequently obtain sensitive key information or bypass intended restrictions on cryptographic operations, via a long key name.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.1 UNKNOWN
NETWORK
HIGH
AV:N/AC:H/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
Affected Products (NVD)
VendorProductVersion
googleandroid
4.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/127185/Android-KeyStore-Stack-Buffer-Overflow.html
http://securityintelligence.com/android-keystore-stack-buffer-overflow-to-keep-things-simple-buffers-are-always-larger-than-needed/
http://www.securityfocus.com/archive/1/532527/100/0/threaded
http://www.securityfocus.com/bid/68152
http://www.slideshare.net/ibmsecurity/android-keystorestackbufferoverflow
http://packetstormsecurity.com/files/127185/Android-KeyStore-Stack-Buffer-Overflow.html
http://securityintelligence.com/android-keystore-stack-buffer-overflow-to-keep-things-simple-buffers-are-always-larger-than-needed/
http://www.securityfocus.com/archive/1/532527/100/0/threaded
http://www.securityfocus.com/bid/68152
http://www.slideshare.net/ibmsecurity/android-keystorestackbufferoverflow