Stagefright (bug)
CVE-2015-1538, CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, CVE-2015-3829, CVE-2015-3864 (Stagefright 1.0),CVE-2015-6602 (Stagefright 2.0) | |
Date discovered | 27 July 2015 |
---|---|
Date patched | 3 August 2015 |
Discoverer | Joshua Drake (Zimperium) |
Affected software | Android 2.2 "Froyo" and later (Stagefright 1.0), Android 1.5 "Cupcake" to Android 5.1 "Lollipop" (Stagefright 2.0) |
Stagefright is the name given to a group of
The underlying
The discovered bugs have been provided with multiple
In order to exploit the vulnerability one doesn't specifically need an MMS message[14] (which was just an example of using the vulnr for RCE), but any other processing of the specifically crafted media by the vulnerable component is enough, that can be done via the most of applications having to deal with media files but not using own-bundled (which increases size of an app and imposes additional unjustified costs on its developer) pure software (which is slow and not energy efficient) media codecs for that, such as media players/galleries, web browsers (can cause drive-by compromise) and file managers showing thumbnails (can be used for achieving persistence).
History
The Stagefright bug was discovered by Joshua Drake from the
The public
On August 13, 2015, another Stagefright vulnerability,
On October 1, 2015, Zimperium released details of further vulnerabilities, also known as Stagefright 2.0. This vulnerability affects specially crafted MP3 and MP4 files that execute their payload when played using the Android Media server. The vulnerability has been assigned identifier
Implications
While Google maintains the Android's primary
As an attempt to address the delays and issues associated with the propagation of Android patches, on August 1, 2015 Zimperium formed the Zimperium Handset Alliance (ZHA) as an association of different parties interested in exchanging information and receiving timely updates on Android's security-related issues. Members of the ZHA also received source code of the Zimperium's proof-of-concept Stagefright exploit before it was publicly released. As of August 6, 2015[update], 25 of the largest Android device OEMs and wireless carriers have joined the ZHA.[12][18][27]
Mitigation
Certain
At first it was thought that further mitigation could come from the address space layout randomization (ASLR) feature that was introduced in Android 4.0 "Ice Cream Sandwich", fully enabled in Android 4.1 "Jelly Bean";[7][29] The version of Android 5.1 "Lollipop" includes patches against the Stagefright bug.[11][30] Unfortunately, later results and exploits like Metaphor that bypass ASLR were discovered in 2016.
As of Android 10, software codecs were moved to a sandbox which effectively mitigates this threat for devices capable of running this version of the OS.[7][31]
See also
- Android version history – a list and descriptions of the released versions of Android
- Another MMS remote code execution vulnerability was found in 2020 for Samsung Android 8.0 (Oreo) to 10.x (Q) smartphones CVE-2020-8899
References
- ^ a b c d e f "Experts Found a Unicorn in the Heart of Android". zimperium.com. July 27, 2015. Retrieved July 28, 2015.
- ^ "Stagefright: Everything you need to know about Google's Android megabug".
- ^ a b c "How to Protect from StageFright Vulnerability". zimperium.com. July 30, 2015. Retrieved July 31, 2015.
- ^ a b Rundle, Michael (July 27, 2015). "'Stagefright' Android bug is the 'worst ever discovered'". Wired. Retrieved July 28, 2015.
- ^ ZDNet. Retrieved July 28, 2015.
- ^ a b Hern, Alex (July 28, 2015). "Stagefright: new Android vulnerability dubbed 'heartbleed for mobile'". The Guardian. Retrieved July 29, 2015.
- ^ CERT. Retrieved July 31, 2015.
- ^ "Android Interfaces: Media". source.android.com. May 8, 2015. Retrieved July 28, 2015.
- ^ "platform/frameworks/av: media/libstagefright". android.googlesource.com. July 28, 2015. Retrieved July 31, 2015.
- ^ Kumar, Mohit (July 27, 2015). "Simple Text Message to Hack Any Android Phone Remotely". thehackernews.com. Retrieved July 28, 2015.
- ^ a b Hackett, Robert (July 28, 2015). "Stagefright: Everything you need to know about Google's Android megabug". Fortune. Retrieved July 29, 2015.
- ^ a b c "Stagefright: Vulnerability Details, Stagefright Detector tool released". zimperium.com. August 5, 2015. Retrieved August 25, 2015.
- ^ a b Gruskovnjak, Jordan; Portnoy, Aaron (August 13, 2015). "Stagefright: Mission Accomplished?". exodusintel.com. Retrieved October 8, 2015.
- ^ "Stagefright Detector - Apps on Google Play".
- ^ Thomas Fox-Brewster (July 30, 2015). "Russian 'Zero Day' Hunter Has Android Stagefright Bugs Primed For One-Text Hacks". Forbes. Retrieved July 31, 2015.
- ^ "Stagefright: Scary Code in the Heart of Android". blackhat.com. August 21, 2015. Retrieved August 25, 2015.
- ^ "Stagefright: Scary Code in the Heart of Android". defcon.org. August 7, 2015. Retrieved August 25, 2015.
- ^ a b "ZHA – Accelerating Roll-out of Security Patches". zimperium.com. August 1, 2015. Retrieved August 25, 2015.
- ^ Joshua J. Drake (May 5, 2015). "Change Ie93b3038: Prevent reading past the end of the buffer in 3GPP". android-review.googlesource.com. Retrieved August 25, 2015.
- ^ Eric Ravenscraft (August 7, 2015). "Stagefright Detector Detects if Your Phone Is Vulnerable to Stagefright". lifehacker.com. Retrieved August 25, 2015.
- ^ "More Stagefright". www.cyanogenmod.org. August 13, 2015. Archived from the original on August 13, 2015. Retrieved August 15, 2015.
- ^ "Stagefright 2.0 Vulnerabilities Affect 1 Billion Android Devices". threatpost.com. October 1, 2015. Retrieved October 1, 2015.
- ^ Jamie Lendino (July 27, 2015). "950M phones at risk for 'Stagefright' text exploit thanks to Android fragmentation". extremetech.com. Retrieved July 31, 2015.
- PC Magazine. Retrieved July 31, 2015.
- ^ Cooper Quintin (July 31, 2015). "StageFright: Android's Heart of Darkness". Electronic Frontier Foundation. Retrieved August 2, 2015.
- Android Central. Retrieved July 29, 2015.
- ^ Lucian Armasu (August 6, 2015). "Zimperium Releases Stagefright Vulnerability Detector". Tom's Hardware. Retrieved August 25, 2015.
- ^ Joshua Drake (August 5, 2015). "Stagefright: Scary Code in the Heart of Android – Researching Android Multimedia Framework Security" (PDF). blackhat.com. pp. 31–39. Retrieved August 25, 2015.
- ^ Jon Oberheide (July 16, 2012). "Exploit Mitigations in Android Jelly Bean 4.1". duosecurity.com. Retrieved July 31, 2015.
- ^ Michael Crider (July 28, 2015). "Google Promises a Stagefright Security Update For Nexus Devices Starting Next Week". androidpolice.com. Retrieved July 31, 2015.
- ^ Jeff Vander Stoep, Android Security & Privacy Team and Chong Zhang, Android Media Team (May 9, 2019). "Queue Hardening Enhancements". android-developers.googleblog.com. Retrieved September 25, 2019.
{{cite web}}
:|author=
has generic name (help)CS1 maint: multiple names: authors list (link)
External links
- Stagefright demo by zLabs on YouTube, August 5, 2015
- Exploits database for the Android platform
- CVE security vulnerabilities for the Google Android
- Google's Android codebase patches against the Stagefright bug: patch #1, patch #2 and patch #3