New Android vulnerabilities disclosed

Google's Android platform is rapidly gaining market share

Security researchers have disclosed two new vulnerabilities in Google's Android mobile platform which could lead to denial-of-service attacks.

The Open Source Computer Emergency Response Team (oCert) warned of two flaws in version 1.5 of the increasingly popular platform, both of which have been patched by Google.

The first involves Android's handling of text messages, according to the oCert security advisory.

"A specific malformed SMS can be crafted to trigger a condition that disconnects the mobile phone from the cellular network," read the advisory.

"The malformed SMS consists of a badly formatted WAP Push message which causes a Java ArrayIndexOutOfBoundsException in the phone application (android.com.phone)."

The phone application then silently reboots, leading to temporary loss of connectivity and dropped calls. If the phone's SIM is protected by a PIN, users will be required to re-enter the code, causing more delays and inconvenience, and if the bug is triggered repeatedly it could lead to denial of service, said oCert.

The second flaw is a vulnerability in Android's Dalvik API. "A specific malicious application can be crafted so that, if it is downloaded and executed by the user, it would trigger the vulnerable API function and restart the system process," said oCert.

"The same condition could occur if a developer unintentionally places the vulnerable function in a place where the execution path leads to that function call. Triggering this bug is considered a denial-of-service condition."