We'd love to be able to publish it in the Play Store, but we were informed by Google that the terms of service disallow any apps that check for vulnerabilities, despite X-Ray's good intentions.
It's a weird distinction that they allow AV-like apps, but not vulnerability assessment apps.
CM9 RC1 is supposed to be running 4.0.4, right? Shouldn't that have been patched already? Though it also appears they have some bigger issues, like everything you type going out to the debug logs, passwords included.
If anyone can quickly point me at the CM9 kernel source, I can verify whether or not this is actually patched.
The vulnerability is looking checking to see if the mem_write() function is functional (where the vulnerability was present), which was removed/disabled by upstream AOSP.
Ran it on Verizon Galaxy Nexus (4.0.4) and it appears everything is patched. Now if they would just get me Jellybean, I would be a really happy camper...
14 comments
[ 0.19 ms ] story [ 58.6 ms ] threadIt's a weird distinction that they allow AV-like apps, but not vulnerability assessment apps.
We posted about some of the security improvements in Jelly Bean 4.1 last week:
https://blog.duosecurity.com/2012/07/exploit-mitigations-in-...
You should report this on their issue tracker: http://code.google.com/p/cyanogenmod/issues/list
The vulnerability is looking checking to see if the mem_write() function is functional (where the vulnerability was present), which was removed/disabled by upstream AOSP.