A security firm researching the safety of the mobile Android operating system has discovered a long list of security bugs, with at least some being thought of as a serious risk.
In a report, security firm Coverity claims to have identified several hundred bugs in the Android operating system. The researchers scoured over 60 million lines of open source code in their Coverity Scan Open Source Integrity Report, including the Android OS source used with the HTC Droid Incredible.
In total, 359 bugs were discovered by the team, with 88 of them categorized as being a “high risk”. Coverity praised Android for having a lower density of bugs per thousand lines of code than average open source software, but said it had a higher bug density than the Linux kernel. Some of the bugs, it argues, should have been caught before release.
All Android distributions are different in some way or another, but it is thought that most Froyo-based Android phones will be vulnerable to the discovered bugs.
Google has responded by preparing over-the-air fixes that it says will be delivered by January at least. The availability of over-the-air fixes is a huge plus for the Android operating system all by itself. Coverity will not disclose details on the vulnerabilities it discovered until patches are available and are being delivered.
Result for: linux
Hector Martin aka marcan42 has just posted to his blog the launch of AsbestOS, a way to run Linux on your jailbroken PS3 without OtherOS. Martin has been working on AsbestOS for over a month.
“Other OS” was disabled by firmware version 3.21, and the latest Sony firmware update is version 3.50. Therefore, only owners of “fat” PS3 consoles running firmwares 3.15 or under can still use the OtherOS feature of their console.
Users running firmware 3.41 or under can “jailbreak” their console using a USB Development Board or a number of items like the DualShock 3 controller, TI-84 calculators, an iPod or other media players.
Says Martin:
“AsbestOS (a mineral, and meaning “inextinguishable” in Greek) is a bootloader to run PS3 Linux without OtherOS. It runs using the USB GameOS exploit (on PS3 version 3.41) from any compatible device, and any reprogrammable devices currently running the PS3 exploit can be used as long as they have enough free internal or external storage (40kB or so) to hold the loader. It is general enough that it should be useful to boot Linux given any other GameOS exploit in the future.
Currently, it only supports netbooting a kernel and no initrd (mostly due to bootmem limitations). This is enough to run a Linux system booting from an NFS share or from USB storage media. Almost everything that works under OtherOS is working. As additional perks of running as GameOS, you also get access to a seventh SPE (needs a kernel patch to enable) and there is clearly full access to the RSX including 3D support, although we still need to learn a few details about how that works to be able to use it.
[More]>>
Result for: linux
Oracle has issued Java and OpenOffice patches today, patching 29 vulnerabilities that would allow attackers to take control of exploited computers.
28 of the vulnerabilities “could be remotely exploitable without authentication (over a network without the need for a username and password),” says Oracle, via ZD.
The patches are available for users running Windows, Linux and Solaris. Mac users are also vulnerable, but security updates are not expected for another month.
Alarmingly, 15 of the vulnerabilities were given a 10.0 Common Vulnerability Scoring System (CVSS-SIG) severity rating. The scale goes from 1 to 10.
Given the severity, Oracle says you should update your system “as soon as possible.”
Check your system for updates here: http://java.com/en/download/installed.jsp
