Menu
Android 4.4.4 fixes OpenSSL connection hijacking flaw

Android 4.4.4 fixes OpenSSL connection hijacking flaw

A new version of Android for Nexus devices is primarily a security update that patches the bundled OpenSSL library

Less than three weeks after pushing Android 4.4.3 to users of its Nexus devices, Google released a new version of the OS that incorporates a patch for a serious vulnerability identified in the OpenSSL cryptographic library.

Android 4.4.4 factory images using build version KTU84P were released for Nexus 4, 5, 7 and 10 late Thursday.

A post on the Sprint community website noted that the update contains security fixes and will be rolled out to devices in batches.

Sascha Prueter, an Android program manager at Google, shed some light on the changes in the new version when answering a question received from a user on his Google+ page.

The update is "primarily addressing CVE-2014-0224," he said.

CVE-2014-0224 is the tracking number in the Common Vulnerabilities and Exposures (CVE) database for a serious security flaw found recently in OpenSSL, one of the most popular libraries for supporting the SSL (Secure Sockets Layer) and TLS (Transport Layer Security) secure communications protocols.

The CVE-2014-0224 vulnerability can be exploited by a man-in-the-middle attacker to decrypt and modify traffic between a client and a server that both use OpenSSL, if the server uses OpenSSL 1.0.1 or a newer version. The flaw was patched in OpenSSL 1.0.1h released on June 5.

According to a recent scan by security vendor Qualys, around 14 percent of the Internet's most popular 155,000 SSL-enabled websites are vulnerable to possible attacks exploiting CVE-2014-0224.

OpenSSL is bundled with Android and the library is used by the Google Chrome browser, as well as other apps, on the mobile platform.

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags patchesAndroid OSonline safetyGooglesecuritymobile securityencryptionExploits / vulnerabilitiesqualys

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments