Ê£¿ô¤ÎAndroid¥¢¥×¥ê¤Ë¥Ñ¥¹¥È¥é¥Ð¡¼¥µ¥ë¤ÎÀȼåÀ¡¢40²¯²ó°Ê¾å¥À¥¦¥ó¥í¡¼¥É
Microsoft¤Ï5·î1Æü(Êƹñ»þ´Ö)¡¢¡Ö¡ÈDirty stream¡É attack: Discovering and mitigating a common vulnerability pattern in Android apps¡ÃMicrosoft Security Blog¡×¤Ë¤ª¤¤¤Æ¡¢¿Íµ¤¤¬¤¢¤ëÊ£¿ô¤ÎAndroid¥¢¥×¥ê¤«¤é¥Ñ¥¹¥È¥é¥Ð¡¼¥µ¥ë¤ÎÀȼåÀ¤¬È¯¸«¤µ¤ì¤¿¤È¤·¤Æ¡¢Ãí°Õ¤ò´µ¯¤·¤¿¡£¤³¤ÎÀȼåÀ¤ò°ÍѤµ¤ì¤ë¤È¡¢É¸Åª¤Î¥¢¥×¥êÆâ¤Î¥Õ¥¡¥¤¥ë¤òÀà¼è¤Þ¤¿¤Ï¾å½ñ¤¤µ¤ì¤ë²ÄǽÀ¤¬¤¢¤ë¡£
¡ÈDirty stream¡É attack: Discovering and mitigating a common vulnerability pattern in Android apps¡ÃMicrosoft Security Blog
¡û¥À¡¼¥Æ¥£¡¼¥¹¥È¥ê¡¼¥à¹¶·â¤Î³µÍ×
Android¤Ç¤Ï¥¢¥×¥ê¤´¤È¤ËÀìÍѤΥǡ¼¥¿Îΰ褬³ä¤êÅö¤Æ¤é¤ì¡¢¥¢¥×¥ê´Ö¤Î¤ä¤ê¼è¤ê¤Ï¥³¥ó¥Æ¥ó¥Ä¥×¥í¥Ð¥¤¥À¡¼(ContentProvider)¤È¸Æ¤Ð¤ì¤ë¥³¥ó¥Ý¡¼¥Í¥ó¥È¤ò²ð¤·¤Æ¹Ô¤ï¤ì¤ë¡£¤³¤Î»ÅÁȤߤˤè¤ê¡¢¥¢¥×¥ê¤¬Ä¾Àܾ¤Î¥¢¥×¥ê¤Î¥Ç¡¼¥¿Îΰè¤Ë¥¢¥¯¥»¥¹¤¹¤ë¤³¤È¤òËɻߤ·¤Æ¤ª¤ê¡¢°°Õ¤Î¤¢¤ë¥¢¥×¥ê¤«¤é¾¤Î¥¢¥×¥ê¤òÊݸ¤Æ¤¤¤ë¡£
¥¢¥×¥ê¤¬Â¾¤Î¥¢¥×¥ê¤È¥Õ¥¡¥¤¥ë¤ò¶¦Í¤¹¤ë¾ì¹ç¡¢¥³¥ó¥Æ¥ó¥Ä¥×¥í¥Ð¥¤¥À¡¼¤ÎFileProvider¥¯¥é¥¹¤òÍøÍѤ¹¤ë¤³¤È¤Ë¤Ê¤ë¡£FileProvider¤òÍøÍѤ¹¤ë¤Ë¤Ï¥¢¥×¥ê¤Î¥Þ¥Ë¥Õ¥§¥¹¥È¤ËÀë¸À¤òµ½Ò¤·¡¢¥Ñ¥¹¤òÀßÄꤹ¤ë¡£¤½¤Î¤¦¤¨¤Ç¥¢¥×¥ê¤ËɬÍפʼÂÁõ¤ò¤¹¤ë¤È¡¢¡Öcontent¡×¥¹¥¡¼¥à¤ò»ÈÍѤ·¤¿URI¤«¤é¥¢¥¯¥»¥¹¤Ç¤¤ë¤è¤¦¤Ë¤Ê¤ë¡£
º£²óȯ¸«¤µ¤ì¤¿ÀȼåÀ¤Ï¡¢¥«¥¹¥¿¥à¤Î¡ÖÌÀ¼¨Åª¥¤¥ó¥Æ¥ó¥È¡×¤òºîÀ®¤·¡¢°°Õ¤Î¤¢¤ë¥Õ¥¡¥¤¥ë̾¤ò¶¦Í¥¿¡¼¥²¥Ã¥È¤ËľÀÜÁ÷¿®¤¹¤ë¼êË¡¤È¤µ¤ì¤ë(»²¹Í¡§¡Ö¥¤¥ó¥Æ¥ó¥È¤È¥¤¥ó¥Æ¥ó¥È¥Õ¥£¥ë¥¿¡¼ | Android Developers¡×)¡£¥³¥ó¥Æ¥ó¥Ä¥×¥í¥Ð¥¤¥À¡¼¤ò²ð¤·¤ÆÁ÷¿®¤µ¤ì¤ë¥Ñ¥¹¤ò³Îǧ¤»¤º¤Ë»ÈÍѤ¹¤ë¤È¡¢ÁÛÄꤷ¤Æ¤¤¤Ê¤¤¥Õ¥¡¥¤¥ë¤ËÉÔÀµ¥¢¥¯¥»¥¹¤µ¤ì¤ë²ÄǽÀ¤¬¤¢¤ë¡£Microsoft¤Ï¤³¤ÎÀȼåÀ¤ò°ÍѤ¹¤ë¹¶·â¤ò¡Ö¥À¡¼¥Æ¥£¡¼¥¹¥È¥ê¡¼¥à¹¶·â¡×¤È̾ÉÕ¤±¤Æ¤¤¤ë¡£
¥À¡¼¥Æ¥£¡¼¥¹¥È¥ê¡¼¥à¹¶·â¤ÎÎã¡¡°úÍÑ¡§Microsoft
¡ûÀȼåÀ¤Î±Æ¶Á¤ÈÂкö
¤³¤ÎÀȼåÀ¤ÏGoogle Play¸ø¼°¥¹¥È¥¢¤«¤éÇÛÉÛ¤µ¤ì¤Æ¤¤¤ëÊ£¿ô¤Î¿Íµ¤¥¢¥×¥ê¤Ë¸ºß¤¹¤ë¤³¤È¤¬³Îǧ¤µ¤ì¤Æ¤¤¤ë¡£¤³¤ì¤é¥¢¥×¥ê¤Î¹ç·×¥À¥¦¥ó¥í¡¼¥É¿ô¤Ï40²¯²ó°Ê¾å¤È¤µ¤ì¡¢Â¿¤¯¤Î¥¨¥ó¥É¥æ¡¼¥¶¡¼¤Ë±Æ¶Á¤·¤Æ¤¤¤ë¤â¤Î¤È¤ß¤é¤ì¤Æ¤¤¤ë¡£Æ±¼Ò¤¬ÀȼåÀ¤¬Êú¤¨¤Æ¤¤¤ë¤³¤È¤òÆÃÄꤷ¤¿¥¢¥×¥ê¥±¡¼¥·¥ç¥ó¤È¤·¤Æ¡¢Xiaomi¤Î File Manager (10 ²¯°Ê¾å¥¤¥ó¥¹¥È¡¼¥ë) ¤ÈWPS Office (5 ²¯°Ê¾å¤Î¥¤¥ó¥¹¥È¡¼¥ë) ¤¬µó¤²¤é¤ì¤Æ¤¤¤ë¡£
ÀȼåÀ¤Î±Æ¶Á¤Ï¥¢¥×¥ê¤Î¥í¡¼¥«¥ë¥Õ¥¡¥¤¥ë¤Ë¤È¤É¤Þ¤é¤Ê¤¤¡£¥¢¥×¥ê¤¬»ñ³Ê¾ðÊó¤òʿʸ¤ÇÊÝ»ý¤·¤Æ¤¤¤ë¾ì¹ç¡¢¤½¤Î»ñ³Ê¾ðÊó¤òÀà¼è¤µ¤ì¤ë²ÄǽÀ¤¬¤¢¤ë¡£Xiaomi¤Î¡ÖMi File Manager¡×¤Ê¤É¤Î¥Õ¥¡¥¤¥ë¥Þ¥Í¡¼¥¸¥ã¡¼¤ÏFTP¤äSMBÀܳ¤ò¥µ¥Ý¡¼¥È¤·¤Æ¤ª¤ê¡¢¤½¤Î»ñ³Ê¾ðÊó¤òʿʸ¤ÇÊݸ¤·¤Æ¤¤¤ë¡£¤½¤Î¤¿¤á¡¢¤³¤ÎÀȼåÀ¤ò°ÍѤµ¤ì¤ë¤È°°Õ¤Î¤¢¤ë¥¢¥×¥ê¤ä¥Õ¥¡¥¤¥ë¥Þ¥Í¡¼¥¸¥ã¡¼¤ò²ð¤·¤Æ¥Ç¡¼¥¿¤òÀà¼è¤µ¤ì¤ë²ÄǽÀ¤¬¤¢¤ë¡£
¥í¡¼¥«¥ë¶¦Í¤Ø¤ÎÉÔÀµ¥¢¥¯¥»¥¹¤ÎÎã¡¡°úÍÑ¡§Microsoft
Microsoft¤Ï¤³¤ÎÀȼåÀ¤Î±Æ¶Á¤ò²óÈò¤¹¤ë¤¿¤á¡¢¥¢¥×¥ê¤Î³«È¯¼Ô¤Ë¥³¥ó¥Æ¥ó¥Ä¥×¥í¥Ð¥¤¥À¡¼¤ò²ð¤·¤ÆÁ÷¤é¤ì¤Æ¤¯¤ë¥Ñ¥¹¤ò´°Á´¤Ë̵»ë¤¹¤ë¤è¤¦¤Ë¿ä¾©¤·¤Æ¤¤¤ë¡£¤³¤ÎÂбþ¤¬¤Ç¤¤Ê¤¤¾ì¹ç¡¢»ØÄꤵ¤ì¤¿¥Ñ¥¹¤¬¥¢¥¯¥»¥¹¤òµö²Ä¤·¤¿¥Õ¥¡¥¤¥ë¤ò»Ø¤·¤Æ¤¤¤ë¤«³Î¼Â¤ÊÊýË¡¤Ç¸¡¾Ú¤¹¤ëɬÍפ¬¤¢¤ë¡£¤Ê¤ª¡¢Uri.getLastPathSegment()¤ò»ÈÍѤ·¤Æ¥Õ¥¡¥¤¥ë̾¤Î¤ß¤ò¼èÆÀ¤¹¤ë¼ÂÁõ¤â¡¢¥¨¥ó¥³¡¼¥É¤µ¤ì¤¿Ê¸»ú¤ò»ÈÍѤ¹¤ë¤³¤È¤Ç¹¶·â²Äǽ¤È¤µ¤ì¤ë¡£¤½¤Î¤¿¤á¡¢¥Ñ¥¹¤Î°ìÉô¤Î¤ß¤òÍøÍѤ¹¤ë¾ì¹ç¤Ë¤ª¤¤¤Æ¤â³Î¼Â¤ÊÊýË¡¤Ç¸¡¾Ú¤¹¤ëɬÍפ¬¤¢¤ë¡£
Android¤Î¥¨¥ó¥É¥æ¡¼¥¶¡¼¤Ë¤Ï¥¢¥×¥ê¤òºÇ¿·¤Î¾õÂÖ¤ËÊݤÁ¡¢¸ø¼°¥¹¥È¥¢¤«¤éÇÛÉÛ¤µ¤ì¤ë¥¢¥×¥ê¤Î¤ß¤ò¥¤¥ó¥¹¥È¡¼¥ë¤¹¤ë¤³¤È¤¬¿ä¾©¤µ¤ì¤Æ¤¤¤ë¡£¤³¤ÎÀȼåÀ¤Ï°°Õ¤Î¤¢¤ë¥¢¥×¥ê¤ò²ð¤·¤Æ¹¶·â¤¬¼Â¹Ô¤µ¤ì¤ë¤¿¤á¡¢°°Õ¤Î¤¢¤ë¥¢¥×¥ê¤Î¥¤¥ó¥¹¥È¡¼¥ë¤ò²óÈò¤¹¤ë¤³¤È¤¬½ÅÍפȤʤ롣Microsoft¤ÏXiaomi¤Î¥¢¥×¥ê¤òÄ̤¸¤ÆSMB¤Þ¤¿¤ÏFTP¶¦Í¤Ë¥¢¥¯¥»¥¹¤·¤Æ¤¤¤¿¥æ¡¼¥¶¡¼¤ËÂФ·¡¢Ç§¾Ú¾ðÊó¤ò¥ê¥»¥Ã¥È¤·¡¢°Û¾ï¤ÊÆ°ºî¤¬¤Ê¤¤¤«Ä´ºº¤¹¤ë¤³¤È¤ò¿ä¾©¤·¤Æ¤¤¤ë¡£
¡û¥À¡¼¥Æ¥£¡¼¥¹¥È¥ê¡¼¥à¹¶·â¤Î³µÍ×
Android¤Ç¤Ï¥¢¥×¥ê¤´¤È¤ËÀìÍѤΥǡ¼¥¿Îΰ褬³ä¤êÅö¤Æ¤é¤ì¡¢¥¢¥×¥ê´Ö¤Î¤ä¤ê¼è¤ê¤Ï¥³¥ó¥Æ¥ó¥Ä¥×¥í¥Ð¥¤¥À¡¼(ContentProvider)¤È¸Æ¤Ð¤ì¤ë¥³¥ó¥Ý¡¼¥Í¥ó¥È¤ò²ð¤·¤Æ¹Ô¤ï¤ì¤ë¡£¤³¤Î»ÅÁȤߤˤè¤ê¡¢¥¢¥×¥ê¤¬Ä¾Àܾ¤Î¥¢¥×¥ê¤Î¥Ç¡¼¥¿Îΰè¤Ë¥¢¥¯¥»¥¹¤¹¤ë¤³¤È¤òËɻߤ·¤Æ¤ª¤ê¡¢°°Õ¤Î¤¢¤ë¥¢¥×¥ê¤«¤é¾¤Î¥¢¥×¥ê¤òÊݸ¤Æ¤¤¤ë¡£
¥¢¥×¥ê¤¬Â¾¤Î¥¢¥×¥ê¤È¥Õ¥¡¥¤¥ë¤ò¶¦Í¤¹¤ë¾ì¹ç¡¢¥³¥ó¥Æ¥ó¥Ä¥×¥í¥Ð¥¤¥À¡¼¤ÎFileProvider¥¯¥é¥¹¤òÍøÍѤ¹¤ë¤³¤È¤Ë¤Ê¤ë¡£FileProvider¤òÍøÍѤ¹¤ë¤Ë¤Ï¥¢¥×¥ê¤Î¥Þ¥Ë¥Õ¥§¥¹¥È¤ËÀë¸À¤òµ½Ò¤·¡¢¥Ñ¥¹¤òÀßÄꤹ¤ë¡£¤½¤Î¤¦¤¨¤Ç¥¢¥×¥ê¤ËɬÍפʼÂÁõ¤ò¤¹¤ë¤È¡¢¡Öcontent¡×¥¹¥¡¼¥à¤ò»ÈÍѤ·¤¿URI¤«¤é¥¢¥¯¥»¥¹¤Ç¤¤ë¤è¤¦¤Ë¤Ê¤ë¡£
º£²óȯ¸«¤µ¤ì¤¿ÀȼåÀ¤Ï¡¢¥«¥¹¥¿¥à¤Î¡ÖÌÀ¼¨Åª¥¤¥ó¥Æ¥ó¥È¡×¤òºîÀ®¤·¡¢°°Õ¤Î¤¢¤ë¥Õ¥¡¥¤¥ë̾¤ò¶¦Í¥¿¡¼¥²¥Ã¥È¤ËľÀÜÁ÷¿®¤¹¤ë¼êË¡¤È¤µ¤ì¤ë(»²¹Í¡§¡Ö¥¤¥ó¥Æ¥ó¥È¤È¥¤¥ó¥Æ¥ó¥È¥Õ¥£¥ë¥¿¡¼ | Android Developers¡×)¡£¥³¥ó¥Æ¥ó¥Ä¥×¥í¥Ð¥¤¥À¡¼¤ò²ð¤·¤ÆÁ÷¿®¤µ¤ì¤ë¥Ñ¥¹¤ò³Îǧ¤»¤º¤Ë»ÈÍѤ¹¤ë¤È¡¢ÁÛÄꤷ¤Æ¤¤¤Ê¤¤¥Õ¥¡¥¤¥ë¤ËÉÔÀµ¥¢¥¯¥»¥¹¤µ¤ì¤ë²ÄǽÀ¤¬¤¢¤ë¡£Microsoft¤Ï¤³¤ÎÀȼåÀ¤ò°ÍѤ¹¤ë¹¶·â¤ò¡Ö¥À¡¼¥Æ¥£¡¼¥¹¥È¥ê¡¼¥à¹¶·â¡×¤È̾ÉÕ¤±¤Æ¤¤¤ë¡£
¥À¡¼¥Æ¥£¡¼¥¹¥È¥ê¡¼¥à¹¶·â¤ÎÎã¡¡°úÍÑ¡§Microsoft
¡ûÀȼåÀ¤Î±Æ¶Á¤ÈÂкö
¤³¤ÎÀȼåÀ¤ÏGoogle Play¸ø¼°¥¹¥È¥¢¤«¤éÇÛÉÛ¤µ¤ì¤Æ¤¤¤ëÊ£¿ô¤Î¿Íµ¤¥¢¥×¥ê¤Ë¸ºß¤¹¤ë¤³¤È¤¬³Îǧ¤µ¤ì¤Æ¤¤¤ë¡£¤³¤ì¤é¥¢¥×¥ê¤Î¹ç·×¥À¥¦¥ó¥í¡¼¥É¿ô¤Ï40²¯²ó°Ê¾å¤È¤µ¤ì¡¢Â¿¤¯¤Î¥¨¥ó¥É¥æ¡¼¥¶¡¼¤Ë±Æ¶Á¤·¤Æ¤¤¤ë¤â¤Î¤È¤ß¤é¤ì¤Æ¤¤¤ë¡£Æ±¼Ò¤¬ÀȼåÀ¤¬Êú¤¨¤Æ¤¤¤ë¤³¤È¤òÆÃÄꤷ¤¿¥¢¥×¥ê¥±¡¼¥·¥ç¥ó¤È¤·¤Æ¡¢Xiaomi¤Î File Manager (10 ²¯°Ê¾å¥¤¥ó¥¹¥È¡¼¥ë) ¤ÈWPS Office (5 ²¯°Ê¾å¤Î¥¤¥ó¥¹¥È¡¼¥ë) ¤¬µó¤²¤é¤ì¤Æ¤¤¤ë¡£
ÀȼåÀ¤Î±Æ¶Á¤Ï¥¢¥×¥ê¤Î¥í¡¼¥«¥ë¥Õ¥¡¥¤¥ë¤Ë¤È¤É¤Þ¤é¤Ê¤¤¡£¥¢¥×¥ê¤¬»ñ³Ê¾ðÊó¤òʿʸ¤ÇÊÝ»ý¤·¤Æ¤¤¤ë¾ì¹ç¡¢¤½¤Î»ñ³Ê¾ðÊó¤òÀà¼è¤µ¤ì¤ë²ÄǽÀ¤¬¤¢¤ë¡£Xiaomi¤Î¡ÖMi File Manager¡×¤Ê¤É¤Î¥Õ¥¡¥¤¥ë¥Þ¥Í¡¼¥¸¥ã¡¼¤ÏFTP¤äSMBÀܳ¤ò¥µ¥Ý¡¼¥È¤·¤Æ¤ª¤ê¡¢¤½¤Î»ñ³Ê¾ðÊó¤òʿʸ¤ÇÊݸ¤·¤Æ¤¤¤ë¡£¤½¤Î¤¿¤á¡¢¤³¤ÎÀȼåÀ¤ò°ÍѤµ¤ì¤ë¤È°°Õ¤Î¤¢¤ë¥¢¥×¥ê¤ä¥Õ¥¡¥¤¥ë¥Þ¥Í¡¼¥¸¥ã¡¼¤ò²ð¤·¤Æ¥Ç¡¼¥¿¤òÀà¼è¤µ¤ì¤ë²ÄǽÀ¤¬¤¢¤ë¡£
¥í¡¼¥«¥ë¶¦Í¤Ø¤ÎÉÔÀµ¥¢¥¯¥»¥¹¤ÎÎã¡¡°úÍÑ¡§Microsoft
Microsoft¤Ï¤³¤ÎÀȼåÀ¤Î±Æ¶Á¤ò²óÈò¤¹¤ë¤¿¤á¡¢¥¢¥×¥ê¤Î³«È¯¼Ô¤Ë¥³¥ó¥Æ¥ó¥Ä¥×¥í¥Ð¥¤¥À¡¼¤ò²ð¤·¤ÆÁ÷¤é¤ì¤Æ¤¯¤ë¥Ñ¥¹¤ò´°Á´¤Ë̵»ë¤¹¤ë¤è¤¦¤Ë¿ä¾©¤·¤Æ¤¤¤ë¡£¤³¤ÎÂбþ¤¬¤Ç¤¤Ê¤¤¾ì¹ç¡¢»ØÄꤵ¤ì¤¿¥Ñ¥¹¤¬¥¢¥¯¥»¥¹¤òµö²Ä¤·¤¿¥Õ¥¡¥¤¥ë¤ò»Ø¤·¤Æ¤¤¤ë¤«³Î¼Â¤ÊÊýË¡¤Ç¸¡¾Ú¤¹¤ëɬÍפ¬¤¢¤ë¡£¤Ê¤ª¡¢Uri.getLastPathSegment()¤ò»ÈÍѤ·¤Æ¥Õ¥¡¥¤¥ë̾¤Î¤ß¤ò¼èÆÀ¤¹¤ë¼ÂÁõ¤â¡¢¥¨¥ó¥³¡¼¥É¤µ¤ì¤¿Ê¸»ú¤ò»ÈÍѤ¹¤ë¤³¤È¤Ç¹¶·â²Äǽ¤È¤µ¤ì¤ë¡£¤½¤Î¤¿¤á¡¢¥Ñ¥¹¤Î°ìÉô¤Î¤ß¤òÍøÍѤ¹¤ë¾ì¹ç¤Ë¤ª¤¤¤Æ¤â³Î¼Â¤ÊÊýË¡¤Ç¸¡¾Ú¤¹¤ëɬÍפ¬¤¢¤ë¡£
Android¤Î¥¨¥ó¥É¥æ¡¼¥¶¡¼¤Ë¤Ï¥¢¥×¥ê¤òºÇ¿·¤Î¾õÂÖ¤ËÊݤÁ¡¢¸ø¼°¥¹¥È¥¢¤«¤éÇÛÉÛ¤µ¤ì¤ë¥¢¥×¥ê¤Î¤ß¤ò¥¤¥ó¥¹¥È¡¼¥ë¤¹¤ë¤³¤È¤¬¿ä¾©¤µ¤ì¤Æ¤¤¤ë¡£¤³¤ÎÀȼåÀ¤Ï°°Õ¤Î¤¢¤ë¥¢¥×¥ê¤ò²ð¤·¤Æ¹¶·â¤¬¼Â¹Ô¤µ¤ì¤ë¤¿¤á¡¢°°Õ¤Î¤¢¤ë¥¢¥×¥ê¤Î¥¤¥ó¥¹¥È¡¼¥ë¤ò²óÈò¤¹¤ë¤³¤È¤¬½ÅÍפȤʤ롣Microsoft¤ÏXiaomi¤Î¥¢¥×¥ê¤òÄ̤¸¤ÆSMB¤Þ¤¿¤ÏFTP¶¦Í¤Ë¥¢¥¯¥»¥¹¤·¤Æ¤¤¤¿¥æ¡¼¥¶¡¼¤ËÂФ·¡¢Ç§¾Ú¾ðÊó¤ò¥ê¥»¥Ã¥È¤·¡¢°Û¾ï¤ÊÆ°ºî¤¬¤Ê¤¤¤«Ä´ºº¤¹¤ë¤³¤È¤ò¿ä¾©¤·¤Æ¤¤¤ë¡£