|
Stagefright is the collective name for a group of software bugs (or more specifically backdoors), that affect versions 2.2 ("Froyo") and newer of the Android operating system, allowing an attacker to perform arbitrary operations on the victim device through remote code execution and privilege escalation. Security researchers demonstrate the bugs with a proof of concept that sends specially crafted MMS messages to the victim device and in most cases requires no end-user actions upon message reception to succeed, while using the phone number as the only target information. The underlying attack vector exploits certain integer overflow vulnerabilities in the Android's core component called "Stagefright",〕}} which is a complex software library implemented primarily in C++ as part of the Android Open Source Project (AOSP) and used as a backend engine for playing various multimedia formats such as MP4 files.〔 The discovered bugs have been provided with multiple Common Vulnerabilities and Exposures (CVE) identifiers, CVE-2015-1538, CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, CVE-2015-3829 and CVE-2015-3864 (the latter one has been assigned separately from the others), which are collectively referred to as the Stagefright bug. == History == The Stagefright bug was discovered by Joshua Drake from the Zimperium security firm, and was publicly announced for the first time on July 27, 2015. Prior to the announcement, Drake reported the bug to Google in April 2015, which incorporated a related bugfix into its internal source code repositories two days after the report.〔〔〔〔 In July 2015, Evgeny Legerov, a Moscow-based security researcher, announced that he found at least two similar heap overflow zero-day vulnerabilities in the Stagefright library, claiming at the same time that the library has been already exploited for a while. Legerov also confirmed that the vulnerabilities he discovered become unexploitable by applying the patches Drake submitted to Google.〔 The public full disclosure of the Stagefright bug, presented by Drake, took place on August 5, 2015 at the Black Hat USA computer security conference, and on August 7, 2015 at the DEF CON 23 hacker convention.〔 Following the disclosure, on August 5, 2015 Zimperium publicly released the source code of a proof-of-concept exploit, actual patches for the Stagefright library (although the patches were already publicly available since early May 2015 in the AOSP and other open-source repositories), and an Android application called "Stagefright detector" that tests whether an Android device is vulnerable to the Stagefright bug.〔 , only a few products have been actually patched against the bug: Blackphone's PrivatOS since its version 117, nightly releases of the CyanogenMod 12.0 and 12.1, Sprint's variant of the Samsung Galaxy Note 4, the Moto E, G, and X, Droid Maxx, Mini, and Turbo,〔https://motorola-global-portal.custhelp.com/app/answers/prod_answer_detail/a_id/106654〕 and Mozilla Firefox since its version 38 (and Firefox OS since 2.2) (this web browser internally uses Android's Stagefright library).〔〔 On August 13, 2015, another Stagefright vulnerability CVE-2015-3864 was published by Exodus Intelligence.〔 This vulnerability was not mitigated by existing fixes of already known vulnerabilities. CyanogenMod team published a notice that patches for CVE-2015-3864 have been incorporated in CyanogenMod 12.1 source on August 13, 2015. On October 1st, 2015, Zimperium released details of further vulnerabilities, also known as Stagefright 2.0. This vulnerability affects specially crafted MP3 and MP4 files that execute their payload when played using the Android Media server. The vulnerability has been assigned identifier CVE-2015-6602 and was found in a core Android library called libutils; a component of Android that has existed since Android was first released. Android 1.5 through 5.1 are vulnerable to this new attack and it is estimated 1 Billion devices are affected 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「Stagefright (bug)」の詳細全文を読む スポンサード リンク
|