Please open a security advisory about archive-patcher HOT 8 OPEN

Hello,

You can provide detailed information on the vulnerability to g.co/AndroidSecurityReport. This will route it into Google's queue of investigation.

Thank you.

from archive-patcher.

This has been reported here: https://issuetracker.google.com/issues/178709136

from archive-patcher.

Thank you again for reporting the issue.

The issue was determined not to be a vulnerability and is being treated as a regular project issue. For this reason, we aren't looking for a security advisory or CVE assignment. We made the necessary changes in our codebase to handle this. The fixes will be cut in the next release cycle.

We can mark this report are resolved now.

from archive-patcher.

The issue was determined not to be a vulnerability and is being treated as a regular project issue. For this reason, we aren't looking for a security advisory or CVE assignment.

Hi!

Could you elaborate a bit more on why you don't believe that this is a vulnerability?

from archive-patcher.

Our investigation showed that:

• On pre-JB devices, the vulnerability could expose the information on which apps are about to be installed on the device to other apps.
• However, the installed apps information becomes public right after the installation completes as the app becomes available on the device.
• For this reason, we identified this as a regular issue and not a vulnerability.

from archive-patcher.

If this vulnerable code is being executed on Android, the system temporary on android is /sdcard on Ice Cream and before.

google/guava#4011 (comment)

As such, file permissions are completely ignored and any other app can rewrite the contents of the files written to /sdcard.

My original disclosure didn't actually consider android. Did your analysis consider cases where this vulnerable code was executed on a unix-like system that was not on android?

In the unix-like system case, doesn't the local information disclosure vulnerability exist?

From my reading of this project's README, there is no indication that this projects code is run exclusively on android, as such, all runnable location contexts need to be considered? Correct?

from archive-patcher.

Archive Patcher is exclusive to Android, and that's a great point that this is not clear in the documentation and it's confusing. We'll open up an issue to fix that; thank you!

from archive-patcher.

Your "compatibility window" seems to indicate that it is also intended to be run on linux.

https://github.com/google/archive-patcher#compatibility-window

from archive-patcher.