CVE-2015-6644

Vulnerability

The vulnerability resides in the Bouncy Castle cryptographic library bundled with Android. A crafted application can exploit this flaw to obtain sensitive information from the device. Affected versions include Android prior to 5.1.1 LMY49F and Android 6.0 before the January 1, 2016 security patch level [4]. Red Hat advisories also reference this CVE in the context of JBoss Enterprise Application Platform and Satellite [2].

Exploitation

An attacker must install a malicious application on the target device. No additional privileges or user interaction beyond installation are required. The application can then leverage the Bouncy Castle vulnerability to access private data [2].

Impact

Successful exploitation results in information disclosure, allowing the attacker to access sensitive user information such as private data stored or processed by the device [2]. The severity is rated Low (CVSS 3.3).

Mitigation

Google released fixes in Android 5.1.1 build LMY49F and Android 6.0 with the January 1, 2016 security patch level [4]. Users should apply these updates via OTA or by flashing the factory images. Red Hat has also included patches in their JBoss EAP and Satellite updates [2]. No workaround is available; updating to the fixed versions is the only mitigation.