CVE-2015-6644

What it actually does

The flaw in the Bouncy Castle cryptographic library permits a local attacker to extract sensitive information from Android devices through a malicious application.

Why it matters to the business

Attackers may obtain confidential data on affected Android devices, resulting in privacy violations and potential compliance issues for organizations managing mobile endpoints.

How an attack unfolds

An attacker creates a crafted application that leverages the Bouncy Castle vulnerability; when a user installs and runs the app, it triggers the information disclosure to retrieve sensitive data.

How to fix it

Upgrade Android to version 5.1.1 LMY49F or 6.0 patched on or after 2016-01-01 to resolve the Bouncy Castle issue.

How to confirm the fix worked

Confirm the device runs Android 5.1.1 LMY49F or a patched 6.0 build; verify resolution of internal bug 24106146 through version checks or security bulletins.

Typical attack path

1. Develop a malicious Android application exploiting the Bouncy Castle flaw
2. Distribute the application via sideloading or third-party stores
3. User installs and executes the application on a vulnerable device
4. Application triggers the vulnerability to disclose sensitive information

How to detect it

Review application installation logs, permission usage, and cryptographic library access patterns for anomalies indicating exploitation by crafted apps.

What your security team should do

• Apply Android security updates to all managed devices immediately
• Audit installed applications for untrusted or sideloaded apps
• Enforce policies restricting application sources on corporate devices