Comments on: QuadRooter Android security flaw https://www.epanorama.net/blog/2016/08/10/quadrooter-android-security-flaw/ All about electronics and circuit design Wed, 22 Apr 2026 08:40:06 +0000 hourly 1 http://wordpress.org/?v=3.9.14 By: Tomi Engdahl https://www.epanorama.net/blog/2016/08/10/quadrooter-android-security-flaw/comment-page-1/#comment-1511601 Wed, 07 Sep 2016 07:19:27 +0000 http://www.epanorama.net/newepa/?p=45166#comment-1511601 Zack Whittaker / ZDNet:
Google fixes final two “Quadrooter” Android flaws, which were rated as “critical”, a month after their disclosure

Google fixes final ‘Quadrooter’ flaws with new security patch
The outstanding flaws were fixed a month after the initial disclosure.
http://www.zdnet.com/article/google-fixes-quadrooter-flaws-in-latest-round-of-android-security-patches/

What took Google a month to fix took others just a couple of weeks.

In the latest round of Android security fixes released Tuesday, the company fixed two remaining flaws that were part of the so-called “Quadrooter” set of vulnerabilities announced last month.

Quadrooter was particularly troublesome because the set of four flaws (hence the name “quad”) affected at least 900 million Android devices. These high-risk vulnerabilities would allow a dedicated and well-trained attacker to gain complete access to an affected phone and its data.

Google, which develops Android, said that most phones had received at least two or even three of the fixes in previous security bulletins. But the rest would remain outstanding for a month, until now, when the company released its regularly-scheduled monthly patches.

According to the bulletin, Google confirmed that the two escalation of privilege bugs — CVE-2016-2059 (rated “high”) and CVE-2016-5340 (rated “critical”) — were fixed.

The Android software and phone maker also fixed six more critical bugs in the mobile operating system, including two remote code execution flaw in core Android components.

]]> By: Tomi Engdahl https://www.epanorama.net/blog/2016/08/10/quadrooter-android-security-flaw/comment-page-1/#comment-1504825 Wed, 10 Aug 2016 16:48:11 +0000 http://www.epanorama.net/newepa/?p=45166#comment-1504825 The problem is there are still so many hands in the pot when it comes to updating Android. Google updates its software, but device makers have to tailor it for their phones — and sometimes they get their software not from Google, but from chipmakers like Qualcomm. And then sometimes mobile carriers want to do their own testing to make sure they aren’t inadvertently introducing other problems onto their network.

All that means the time from when a flaw is identified or disclosed to when it is fixed is longer than it should be, sometimes leaving hundreds of millions of phones vulnerable for weeks or months.

“The problem continues to be that Android security updates are really hard because of [their] fragmented ecosystem,” said Check Point mobile security evangelist Jeff Zacuto told Recode.

Source: http://www.recode.net/2016/8/8/12403088/android-security-mess-quadrooter

]]>