Don’t be an April Fool: Update Your Android Mobes, Gizmos to – Hopefully – Pick up Critical Security Fixes (Apr 2, 2019)
Google has addressed its monthly patch release in two batches for April to address 11 CVE-registered vulnerabilities and 44 flaws. Two of the 11 CVE vulnerabilities, “CVE-2019-2027” and “CVE-2019-2028,” are Remote Code Execution (RCE) vulnerabilities and could be exploited by a threat actor by convincing someone to open a malicious message or video. The other nine CVEs consist of a privilege escalation vulnerability that could be exploited by an installed application, eight located in the Android system, five other privilege escalation flaws, and three that expose information. The nine vulnerabilities are all rated as “high severity.”
Recommendation: Always keep your mobile phone fully patched with the latest security updates. Use the Google Play Store / Apple App Store to obtain your software, and avoid downloading applications, even if they appear legitimate, from third-party stores. The Android Security Bulletin can be viewed here: “https://source.android.com/security/bulletin/2019-04-01”
Indicators of Compromise (IOCs) associated with this story can be viewed by ThreatStream users here to identify potential malicious activity.