CVE identifier(s) | CVE-2015-1538, CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, CVE-2015-3829, CVE-2015-3864 (Stagefright 1.0), CVE-2015-6602 (Stagefright 2.0) |
---|---|
Date discovered | 27 July 2015 |
Date patched | 3 August 2015 |
Discoverer | Joshua Drake (Zimperium) |
Affected software | Android 2.2 "Froyo" and later (Stagefright 1.0), Android 1.5 "Cupcake" to Android 5.1 "Lollipop" (Stagefright 2.0) |
Stagefright is the name given to a group of software bugs that affect versions from 2.2 "Froyo" up until 5.1.1 "Lollipop"[1] of the Android operating system exposing an estimated 950 million devices (95% of all Android devices) at the time.[1] The name is taken from the affected library, which among other things, is used to unpack MMS messages.[2] Exploitation of the bug allows an attacker to perform arbitrary operations on the victim's device through remote code execution and privilege escalation.[3] Security researchers demonstrate the bugs with a proof of concept that sends specially crafted MMS messages to the victim device and in most cases requires no end-user actions upon message reception to succeed—the user doesn't have to do anything to 'accept' exploits using the bug; it happens in the background. A phone number is the only information needed to carry out the attack.[4][5][6][1]
The underlying attack vector exploits certain integer overflow vulnerabilities in the Android core component called libstagefright,[7][8][9] which is a complex software library implemented primarily in C++ as part of the Android Open Source Project (AOSP) and used as a backend engine for playing various multimedia formats such as MP4 files.[1][10]
The discovered bugs have been provided with multiple Common Vulnerabilities and Exposures (CVE) identifiers, CVE-2015-1538, CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, CVE-2015-3829 and CVE-2015-3864 (the latter one has been assigned separately from the others), which are collectively referred to as the Stagefright bug.[11][12][13]
In order to exploit the vulnerability one doesn't specifically need an MMS message[14] (which was just an example of using the vulnr for RCE), but any other processing of the specifically crafted media by the vulnerable component is enough, that can be done via the most of applications having to deal with media files but not using own-bundled (which increases size of an app and imposes additional unjustified costs on its developer) pure software (which is slow and not energy efficient) media codecs for that, such as media players/galleries, web browsers (can cause drive-by compromise) and file managers showing thumbnails (can be used for achieving persistence).