The Lookout Blog

LOOK-11-001

[Vulnerability Identifier]: LOOK-11-001

[Product]: Lookout Mobile Security

[Platform]: Android

[Effect]:
Features of the application may be disabled and reconfigured.  Local privilege escalation to perform some actions authorized for the application.

[Details]:
The Lookout Mobile Security client for Android creates certain configuration and database files through native IO calls without setting an explicit umask for the process.  As the umask inherited from the Android Zygote is 000, the client creates its configuration and database files mode 666 (world-readable, world-writable).  As a result, the configuration state of the client is exposed to local manipulation including enabling/disabling client functions, exposing access to user data, and manipulating content types and locations for backup/restore.

[Fix]:
Lookout v5.1.1 was pushed to the Android Market on January 3rd, 2011. Users who have not already updated are advised to update immediately from the Market.  Users that are unable to update from the Market can update their client from http://www.getjar.com/mobile/25094/lookout-mobile-security-with-antivirus/.

[Acknowledgment]:
Lookout would like to thank Tavis Ormandy of Google who discovered the issue.