Android Stagefright 2.0 Media Library Remote Code Execution Vulnerabilities

Impact

• Remote Code Execution

System / Technologies affected

• Android versions 1.0 to 5.x

Solutions

• Note:
  • Vendor patch is currently unavailable.
• Workaround:
  1. Proceed with special caution when using your mobile browser to preview unsolicited audio and video files.
  2. Turn off "Auto Retrieve" for multimedia messages (MMS) under "Settings", go to "SMS"/"Multimedia message".
     Note: For this workaround, you may find more information for your device model in the following webpage:
     https://www.twilio.com/blog/2015/07/how-to-protect-your-android-device-from-stagefright-exploit.html
  Note: The following 3 solutions may impose the risk of losing important information dedicated to you. Please assess the risk before making the decision.
  
  2. Block all text messages from unknown senders. Usually, you can enable such option under "Settings".
  3. Do not open MMS sent by unknown parties.
  4. Remove all MMS related settings under Access Point Name (APN).

Vulnerability Identifier

• CVE-2015-3876
• CVE-2015-6602

Source

• Zimperium
• SecurityTracker

Related Link

• https://blog.zimperium.com/zimperium-zlabs-is-raising-the-volume-new-vulnerability-processing-mp3mp4-media/
• http://securitytracker.com/id/1033725