Improper installation of unsigned code
ID: ANDROID-8219321
Severity: High
Affected versions: Android 2.0 and greater
An inconsistency in the handling of zip files during application installation may lead to the installation and execution of unsigned code in a privileged context.
This issue will be publicly disclosed in 90 days. A CTS test will be included in the next CTS release.
5月：
Insertion of arbitrary code without changing package signature due to incorrect parsing of APKs (update to previous bulletin)
First published: March 4th, 2013
Last Updated: May 31st, 2013
ID: ANDROID-8219321
Severity: High
Affected Android Versions: all
Arbitrary code can be inserted into an APK and pass signature verification due to incorrect parsing of APKs. A maliciously crafted classes.dex can be inserted before a legitimately signed classes.dex in an APK. Signature verification will be performed on the second, legitimate classes.dex, but the first, malicious classes.dex is installed for application use.
Update: This issue will be publicly presented at Blackhat 2013. Please see http://www.blackhat.com/us-13/briefings.html#Forristal for more details. At that time, we expect active public exploitation of this issue outside of Google Play.
