Vulnerability Note VU#924951
Android Stagefright contains multiple vulnerabilities
Original Release date: 28 Jul 2015 | Last revised: 02 Sep 2015

Overview
Stagefright is the media playback service for Android, introduced in Android 2.2 (Froyo). Stagefright in versions of Android prior to 5.1.1_r9 may contain multiple vulnerabilities, including several integer overflows, which may allow a remote attacker to execute code on the device.

Description
According to a Zimperium zLabs blog post, Android’s Stagefright engine contains multiple vulnerabilities, including several integer overflows, allowing a remote attacker to access files or possibly execute code on the device. This vulnerability may at least partially affect all versions of Android starting from 2.2 (Froyo) and prior to 5.1.1_r9 (Lollipop).
An attacker with a victim’s cell phone number may send maliciously crafted multimedia messages (MMS) which may be improperly parsed by the Stagefright tool. Other attack vectors include client-side (web browsers, downloads, email), physically adjacent (NFC, Bluetooth, VCards), physical (SD cards, USB on-the-go, USB Media Transfer Protocol and Picture Transfer Protocol), Gallery, and possibly others not yet identified.

According to Ars Technica, "successful exploits at the very least provide direct access to a phone’s audio and camera feeds and to the external storage … many older phones grant elevated system privileges to Stagefright code, a design that could allow attackers access to many more device resources."

Zimperium has released more information on these vulnerabilities, including a proof of concept code, patches, a video demoing the exploit and an Android app that detects the vulnerability.

The vulnerabilities include:
1. CVE-2015-1538, P0006, Google Stagefright ‘stsc’ MP4 Atom Integer Overflow Remote Code Execution
2. CVE-2015-1538, P0004, Google Stagefright ‘ctts’ MP4 Atom Integer Overflow Remote Code Execution
3. CVE-2015-1538, P0004, Google Stagefright ‘stts’ MP4 Atom Integer Overflow Remote Code Execution
4. CVE-2015-1538, P0004, Google Stagefright ‘stss’ MP4 Atom Integer Overflow Remote Code Execution
5. CVE-2015-1539, P0007, Google Stagefright ‘esds’ MP4 Atom Integer Underflow Remote Code Execution
6. CVE-2015-3827, P0008, Google Stagefright ‘covr’ MP4 Atom Integer Underflow Remote Code Execution
7. CVE-2015-3826, P0009, Google Stagefright 3GPP Metadata Buffer Overread
8. CVE-2015-3828, P0010, Google Stagefright 3GPP Integer Underflow Remote Code Execution
9. CVE-2015-3824, P0011, Google Stagefright ‘tx3g’ MP4 Atom Integer Overflow Remote Code Execution
10. CVE-2015-3829, P0012, Google Stagefright ‘covr’ MP4 Atom Integer Overflow Remote Code Execution

Since integer overflow is a type of memory error, Address Space Layout Randomization (ASLR) appears to partially mitigate this issue; Forbes reports that Android before 4.1 (Jelly Bean) have "inadequate exploit mitigations." ASLR was introduced in Android 4.0 and fully enabled in Android 4.1.

Impact
A remote attacker may be able to execute code on the Android device.

Solution
Apply an update

The Android Open Source Project (AOSP) has released Android 5.1.1_r9 to address this issue. Currently this update is only available for Nexus, Samsung and HTC phones (AT&T has pushed this over the air). According to The Register, Google expects updates to roll out to some models in the September over-the-air update.

In the US, cell phone carriers largely control the updating process. The update may or may not be available for your phone. Contact your cell phone carrier or manufacturer for update information.

Note that in the aftermath of the original disclosure, it has been determined that the original patches fail to completely resolve the original vulnerability. CVE-2015-3864 has been assigned by Google to identify the issue identified in a blog post by Exodus Intelligence, and updates are to be available as previously described.

Alternatively, the MMS attack vector of this vulnerability may be mitigated by the following workarounds:
Block all text messages from unknown senders

Blocking all text messages from unknown senders in your default text message handling app may mitigate this issue.

Turn off "Auto Retrieve" for multimedia messages
If your default text messaging app does not allow blocking of senders, you may also disable the auto retrieve feature for multimedia messages. This may prevent the autoloading of MMS content into Stagefright.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAmazonAffected-28 Jul 2015
Barnes and NobleAffected-28 Jul 2015
GoogleAffected-28 Jul 2015
HTCAffected-15 Aug 2015
Huawei TechnologiesAffected-28 Jul 2015
Kyocera CommunicationsAffected-28 Jul 2015
LG ElectronicsAffected-28 Jul 2015
Motorola, Inc.Affected-28 Jul 2015
Samsung MobileAffected-07 Aug 2015
Sony CorporationAffected-28 Jul 2015If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
5.8
AV:N/AC:M/Au:N/C:P/I:P/A:N

Temporal
4.7
E:POC/RL:W/RC:UR

Environmental
3.5
CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Stagefright: Vulnerability Details, Stagefright Detector tool released

Experts Found a Unicorn in the Heart of Android


http://www.forbes.com/sites/thomasbrewster/2015/07/27/android-text-attacks/
http://www.zdnet.com/article/stagefright-just-how-scary-is-it-for-android-users/
http://arstechnica.com/security/2015/07/950-million-android-phones-can-be-hijacked-by-malicious-text-messages/
https://android.googlesource.com/platform/frameworks/av/+/0e4e5a8%5E!/
https://android.googlesource.com/platform/frameworks/av/+/5c134e6%5E!/
https://android.googlesource.com/platform/frameworks/av/+/030d8d0%5E!/
http://source.android.com/devices/media.html
https://developers.google.com/android/nexus/images
https://www.duosecurity.com/blog/exploit-mitigations-in-android-jelly-bean-4-1

Stagefright: Mission Accomplished?


http://www.theregister.co.uk/2015/08/17/botched_google_stagefright_fix_wont_be_resolved_until_september/
http://www.htc.com/us/support/htc-one-m8-att/news/

Credit

Thanks to Joshua Drake at Zimperium’s zLabs for working with Google to develop patches and publicly disclose these vulnerabilities. Thanks to Jordan Gruskovnjak and Aaron Portnov of Exodus Intelligence for identifying and disclosing the issues with the original patches.
This document was written by Garret Wassermann.

Other Information

CVE IDs:
CVE-2015-1538
CVE-2015-1539
CVE-2015-3824
CVE-2015-3826
CVE-2015-3827
CVE-2015-3828
CVE-2015-3829
CVE-2015-3864

Date Public:
21 Jul 2015

Date First Published:
28 Jul 2015

Date Last Updated:
02 Sep 2015

Document Revision:
108

FeedbackIf you have feedback, comments, or additional information about this vulnerability, please send us email.

Leave a Reply