I was sent this interesting article; http://venturebeat.com/2015/12/31/software-with-the-most-vulnerabilities-in-2015-mac-os-x-ios-and-flash/
So I hate Apple, but in the last analysis I did I found that OSX wasn't actually that bad compared to Microsofts most popular OS at the moment Windows7, I would have to say on par, go to the link at the top to read this. This time I am similarly analysing Google's Android and Apple's iPhone OS(IOS).
Now to precursor this, I am almost an Android fanboi, I have android tablets (4 at last count, 3 from dx.com that all died), and my although my first smartphone was Symbian, all since have been Android. My kids do have iPads and my wife does have an iPhone though, but this is more for the apps available. There are things on both platforms that I wish the other would do, but Android is far and away more flexible, but like last time... don't get me started on my Apple-hate.
Now onto the Andorid/IOS analysis, as I started with MS last time, I'll start with Android this time.
Google's Android (as opposed the Motorola version that is listed at CVEDetails) had 130 vulnerabilities in 2015. With an average across those vulnerabilities of 8.37 (seems a bit high), standard deviation was 2.23. If we then round all the scores (down if they are .4 and below, up if they are .5 and above we get the below);
But I did find the almost obligatory Adobe Flash vulnerabilities in there. 21 of the 61 CVSS 10's were flash, good thing Google dropped it from their 4.1 (KitKat) release of the OS... an OS released 4 and a half years ago. So I don't think these should be included, still an awful lot of CVSS score 10's lets look at some.
In case you didn't know this is the decade where security researchers learned some marketing, and started to brand their discoveries with cool names and logos like heartbleed. Well Stagefright was a bug of this ilk that was actually a big deal on Android. Patched no less than 38 times, of these 49
With words like libstagefright (where the bug got its name), MPEG4Extractor, Skia, Sonivox and mediaserver these are all related to stagefright, in fact of the CVSS 10 bugs remaining after Adobe and Stagefright there seems to be only one CVE-2015-1474.
Here are two examples of some obscurely described but Stagefright related bugs;
CVE-2015-6609
libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624.
CVE-2015-3836
The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1 LMY48I does not reject a negative value for a certain size field, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted XMF data, aka internal bug 21132860.
Interestingly three CVE-2014's (7915, 7916 and 7917) exist on this list, all related to stagefright. I believe these CVE id's were allocated prior to the bugs disclosure.
So the only non-Adobe, non-stagefright bug was;
CVE-2015-1474
Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of (1) file descriptors or (2) integer values.A pretty nasty one, allows a malicious app to escalate its privileges via the graphic buffer, though not remote exploitation. Essentially if a user installs a dodgy app they could give a bad guy access to more than they should.
Pretty sure all those Adobe bugs shouldn't be in there to be fair. And they probably should have fixed the stagefright bug in one go, but I guess it was a pervasive library, hence all the issues found and fixed.
Stagefright was pretty bad, it essentially meant with the right media file (audio on a webpage for example or the proof of concept MMS attachment), it could get your phone to run a command. So it is remote code execution, the ultimate vulnerability for any OS. But it was specific, you needed to know the app the user was opening your media file in, to be sure it used the library. I think it does deserve the CVSS score of 10, not sure about the adobe ones though seeing as most androids don't run it anymore.
******************************************
On to iPhone OS (IOS)
IOS had a whopping 375 vulnerabilities last year. With a much lower average than Andorids at 6.13 (versus Android 8.37). It's standard deviation was also smaller at 1.82. This is probably due to the 61 CVSS 10's that android had. Lets have a look at the graph;
Interestingly there are a tonne of CVSS 7's there, a lot of those were a vulnerability in Webkit (Apple Safari) that allowed a remote attacker to crash the app with a specially crafted website. I am sure this probably allows the attacker to run code too, so it should probably be higher... Most denial of services if done right end in compromise, but anyway.
I'll have a look at some of the more interesting CVSS 10 rated vulnerabilities.
I'll have a look at some of the more interesting CVSS 10 rated vulnerabilities.
CVE-2015-6988
The kernel in Apple iOS before 9.1 and OS X before 10.11.1 does not initialize an unspecified data structure, which allows remote attackers to execute arbitrary code via vectors involving an unknown network-connectivity requirement.
This one looks particularity nasty, and also affected OSX and I mentioned it in the other post. Definitely worthy of its 10 score. On a mobile this could be very bad if the "unknown network-connectivity" included something sent over say the GSM cellular network.CVE-2014-4495
The kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not enforce the read-only attribute of a shared memory segment during use of a custom cache mode, which allows attackers to bypass intended access restrictions via a crafted app.
This one I didn't mention in the other post, but it isn't that bad. It essentially allows an application already on the phone or Mac to read memory it shouldn't be able to, this could allow this app to escalate permissions or disable some other security measure. I'd give this a solid 9, but 10 seems high.
CVE-2014-4480
Directory traversal vulnerability in afc in AppleFileConduit in Apple iOS before 8.1.3 and Apple TV before 7.0.3 allows attackers to access unintended filesystem locations by creating a symlink.
This one seems to be IOS/AppleTV only, which is interesting. Accessing locations just by creating a symlink is pretty cool. Not remotely exploitable, but could help out a bad guy already on a system. Again I don't think it is a 9, perhaps marked too harsh.
Conclusion
As with the other post, even though IOS has more bugs than Android, it isn't the number of bugs that matter so much, it is type and quality. Android has a higher average and a lot more rated 10's, with this all in account it is a pretty even match.
Yes Safari is insecure, stagefright was a big stuff up, flash and reader are terrible, but the OS's themselves seem to be pretty much on par.
Thanks to CVEdetails for their site and access to the list of vulnerabilities. The compiled spreadsheet is here, under fair use.
No comments:
Post a Comment