by George Chetcuti

Trend Micro security experts discovered a vulnerability in Android that affects how cross-signed certificates are handled.

When a specially-constructed malformed certificate is introduced into an Android device, the system may behave in unexpected ways. It may either slow down or hang the device until it is forced to reboot. The vulnerability is caused by two common used classes in the Android framework – the JarFile and KeyStore classes. Any Android features implicitly or explicitly using the either of two classes may be at the risk to be attacked by cross-signed certificates.

Read more here – http://blog.trendmicro.com/trendlabs-security-intelligence/cross-signed-certificates-crashes-android/