search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Android Stagefright contains multiple vulnerabilities

Vulnerability Note VU#924951

Original Release Date: 2015-07-28 | Last Revised: 2016-01-08

Overview

Stagefright is the media playback service for Android, introduced in Android 2.2 (Froyo). Stagefright in versions of Android prior to 5.1.1_r9 may contain multiple vulnerabilities, including several integer overflows, which may allow a remote attacker to execute code on the device.

Description

According to a Zimperium zLabs blog post, Android's Stagefright engine contains multiple vulnerabilities, including several integer overflows, allowing a remote attacker to access files or possibly execute code on the device. This vulnerability may at least partially affect all versions of Android starting from 2.2 (Froyo) and prior to 5.1.1_r9 (Lollipop).

An attacker with a victim's cell phone number may send maliciously crafted multimedia messages (MMS) which may be improperly parsed by the Stagefright tool. Other attack vectors include client-side (web browsers, downloads, email), physically adjacent (NFC, Bluetooth, VCards), physical (SD cards, USB on-the-go, USB Media Transfer Protocol and Picture Transfer Protocol), Gallery, and possibly others not yet identified.

According to Ars Technica, "successful exploits at the very least provide direct access to a phone's audio and camera feeds and to the external storage ... many older phones grant elevated system privileges to Stagefright code, a design that could allow attackers access to many more device resources."

Zimperium has released an update on 2015-09-09 to their previous information on these vulnerabilities, including a proof of concept code, patches, a video demoing the exploit and an Android app that detects the vulnerability.

The vulnerabilities include:
1.CVE-2015-1538, P0006, Google Stagefright ‘stsc’ MP4 Atom Integer Overflow Remote Code Execution
2.CVE-2015-1538, P0004, Google Stagefright 𠆌tts’ MP4 Atom Integer Overflow Remote Code Execution
3.CVE-2015-1538, P0004, Google Stagefright ‘stts’ MP4 Atom Integer Overflow Remote Code Execution
4.CVE-2015-1538, P0004, Google Stagefright ‘stss’ MP4 Atom Integer Overflow Remote Code Execution
5.CVE-2015-1539, P0007, Google Stagefright 𠆎sds’ MP4 Atom Integer Underflow Remote Code Execution
6.CVE-2015-3827, P0008, Google Stagefright 𠆌ovr’ MP4 Atom Integer Underflow Remote Code Execution
7.CVE-2015-3826, P0009, Google Stagefright 3GPP Metadata Buffer Overread
8.CVE-2015-3828, P0010, Google Stagefright 3GPP Integer Underflow Remote Code Execution
9.CVE-2015-3824, P0011, Google Stagefright ‘tx3g’ MP4 Atom Integer Overflow Remote Code Execution
10.CVE-2015-3829, P0012, Google Stagefright 𠆌ovr’ MP4 Atom Integer Overflow Remote Code Execution

Zimperium has also released a second round of Stagefright vulnerabilities on 2015-10-01. Processing specially crafted MP3 or MP4 files can lead to arbitrary code execution.

    1. CVE-2015-6602, Google libutils vulnerability
    2. CVE-2015-6610, Google libstagefright vulnerability

    In the November 2015 Security Bulletin, Google announced fixes for the Stagefright 2.0 vulnerabilities will soon be applied to the Android Open Source Project (AOSP) code.

    Address Space Layout Randomization (ASLR) appears to partially mitigate this issue; Forbes reports that Android before 4.1 (Jelly Bean) have "inadequate exploit mitigations." ASLR was introduced in Android 4.0 and fully enabled in Android 4.1.

    Impact

    A remote attacker may be able to execute code on the Android device.

    Solution

    Apply an update

    The Android Open Source Project (AOSP) has released Android 5.1.1_r9 to address the original issues. The newer "Stagefright 2.0" issues have been addressed in Nexus build LMY48K or later, or Android Marshmallow with Security Patch Level of November 1, 2015 or later.

    Partial fixes are available for Nexus (now being pushed over the air), Samsung and HTC phones (AT&T has pushed this over the air).

    In the US, cell phone carriers largely control the updating process. The update may or may not be available for your phone. Contact your cell phone carrier or manufacturer for update information.

    Note that in the aftermath of the original disclosure, it has been determined that the original patches fail to completely resolve the original vulnerability. CVE-2015-3864 has been assigned by Google to identify the issue identified in a blog post by Exodus Intelligence, and updates are to be available as previously described.

    Alternatively, the MMS attack vector of this vulnerability may be mitigated by the following workarounds:

    Block all text messages from unknown senders

    Blocking all text messages from unknown senders in your default text message handling app may mitigate this issue.

    Turn off "Auto Retrieve" for multimedia messages

    If your default text messaging app does not allow blocking of senders, you may also disable the auto retrieve feature for multimedia messages. This may prevent the autoloading of MMS content into Stagefright.

    Vendor Information

    924951
    Expand all

    Amazon

    Updated:  July 28, 2015

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    We are not aware of further vendor information regarding this vulnerability.

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.

    Barnes and Noble

    Updated:  July 28, 2015

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    We are not aware of further vendor information regarding this vulnerability.

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.

    Google

    Updated:  July 28, 2015

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    We are not aware of further vendor information regarding this vulnerability.

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.

    HTC

    Updated:  August 15, 2015

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    HTC is providing patches for some model phones, see the references below.

    Vendor References

    http://www.htc.com/us/support/htc-one-m8-sprint/news/

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.

    Huawei Technologies

    Updated:  July 28, 2015

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    We are not aware of further vendor information regarding this vulnerability.

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.

    Kyocera Communications

    Updated:  July 28, 2015

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    We are not aware of further vendor information regarding this vulnerability.

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.

    LG Electronics

    Updated:  July 28, 2015

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    We are not aware of further vendor information regarding this vulnerability.

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.

    Motorola, Inc.

    Updated:  July 28, 2015

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    We are not aware of further vendor information regarding this vulnerability.

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.

    Mozilla

    Updated:  January 08, 2016

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    We are not aware of further vendor information regarding this vulnerability.

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.

    Samsung Mobile

    Updated:  August 07, 2015

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    Samsung has released an update:

    Vendor References

    http://www.sammobile.com/2015/08/06/stagefright-fix-for-the-galaxy-s6-galaxy-s5-and-galaxy-note-4-released-by-att/

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.

    Sony Corporation

    Updated:  July 28, 2015

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    We are not aware of further vendor information regarding this vulnerability.

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.


    CVSS Metrics

    Group Score Vector
    Base 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N
    Temporal 4.7 E:POC/RL:W/RC:UR
    Environmental 3.5 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

    References

    Credit

    Thanks to Joshua Drake at Zimperium’s zLabs for working with Google to develop patches and publicly disclose these vulnerabilities. Thanks to Jordan Gruskovnjak and Aaron Portnov of Exodus Intelligence for identifying and disclosing the issues with the original patches.

    This document was written by Garret Wassermann.

    Other Information

    CVE IDs: CVE-2015-1538, CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, CVE-2015-3829, CVE-2015-3864, CVE-2015-6602
    Date Public: 2015-07-21
    Date First Published: 2015-07-28
    Date Last Updated: 2016-01-08 14:19 UTC
    Document Revision: 126

    Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.