new Android vulnerability by processing mp3 / mp4 media

[zMeul]

source: https://blog.zimperium.com/zimperium-zlabs-is-raising-the-volume-new-vulnerability-processing-mp3mp4-media/

 

Following our discovery of vulnerabilities in the Stagefright library in April, Zimperium Mobile Threat Protection, zLabs VP of Research Joshua J. Drake continued researching media processing in Android. His continued research, which focused on remote attacks against current devices, led to the discovery of yet another security issue.

Meet Stagefright 2.0, a set of two vulnerabilities that manifest when processing specially crafted MP3 audio or MP4 video files. The first vulnerability (in libutils) impacts almost every Android device since version 1.0 released in 2008. We found methods to trigger that vulnerability in devices running version 5.0 and up using the second vulnerability (in libstagefright). Google assigned CVE-2015-6602 to vulnerability in libutils. We plan to share CVE information for the second vulnerability as soon as it is available.

What is the impact of this issue?

• Confirmed remote code execution (RCE) impact via libstagefright on Android 5.0 and later.
• Older devices may be impacted if the vulnerable function in libutils is used (using third party apps, vendor or carrier functionality pre-loaded to the phone).

What is the vulnerability ?
Processing specially crafted MP3 or MP4 files can lead to arbitrary code execution.

How the attack can be triggered ?

The vulnerability lies in the processing of metadata within the files, so merely previewing the song or video would trigger the issue. Since the primary attack vector of MMS has been removed in newer versions of Google’s Hangouts and Messenger apps, the likely attack vector would be via the Web browser.

1. An attacker would try to convince an unsuspecting user to visit a URL pointing at an attacker controlled Web site (e.g., mobile spear-phishing or malicious ad campaign)
2. An attacker on the same network could inject the exploit using common traffic interception techniques (MITM) to unencrypted network traffic destined for the browser.
3. 3rd party apps (Media Players, Instant Messengers, etc.) that are using the vulnerable library.

 

 

 

---

 

yes, Google will patch this fairly quickly for the hardware they have direct control of, Nexus devices; but what about the rest?

it is very well known Android device makers are slow or outright not interested in updating their handsets for patching up vulnerabilities

 

for example, I have a Vodafone Smart III that hasn't received a SW update, ever; it's still vulnerable to HeartBleed OpenSSL exploit .. Vodafone's response? they claim the device isn't vulnerable at all  <_<

[You_are_a_cunt]

*looks at his Windows Phone and laughs hysterically*

[DIV1D3]

This newer security vulnerability seems quite frightening...

[PlayStation 2]

I shouldn't be saying this, but I'm glad I went with iOS instead of an Android device...

[Valentyn]

Mp3gate! Users beware! The Gates are upon us.

 

I hope this gets fixed soon, but the fragmented nature of Android is a big issue for many, even if they don't realise it with their device.

[dfsdfgfkjsefoiqzemnd]

MP3 is for peasants anyway.

 

#FLACMasterRace

[ShadowCaptain]

Quick everyone laugh at how android is shit

/s

[colonel_mortis]

http://linustechtips.com/main/topic/459659-stagefright-20-android-under-attack-once-again/