Pierluigi Paganini
July 30, 2015
Experts from Trend Micro discovered a new vulnerability, an integer overflow bug in the Android mediaserver service, that affects versions of Android starting with 4.3 Jelly Bean and up to 5.1.1 Lollipop. The flaw potentially affects half of the Android devices that are running the flawed versions.
An attacker can trigger the Android vulnerability by sending a malformed video file using the Matroska container. The attacker can exploit the flaw to make the targeted smartphone inoperable and silent, the attack completely mute the device making the user interface unresponsive.
“The vulnerability is caused by an integer overflow when the mediaserver service parses an MKV file. It reads memory out of buffer or writes data to NULL address when parsing audio data,” states a blog post published by Trend Micro.
An attacker can remotely exploit the denial-of-service (DoS) flaw to force the victim to install a malicious app or visit a website used to serve a malware. Another option for the attacker is to use a malicious app containing an embedded MKV file that makes the smartphone unresponsive.
“This vulnerability can be exploited in two ways: either via a malicious app installed on the device, or through a specially-crafted web site. The first technique can cause long-term effects to the device: an app with an embedded MKV file that registers itself to auto-start whenever the device boots would case the OS to crash every time it is turned on.” continues the post.
In a video proof-of-concept the experts demonstrated how to run a local Denial of Service Attack exploiting the flaw to cause the mediaserver service to continuously restart once the Android vulnerability is triggered.
“Whatever means is used to lure in users, the likely payload is the same. Ransomware is likely to use this vulnerability as a new ‘threat’ for users: in addition to encrypting on the device being encrypted, the device itself would be locked out and unable to be used. This would increase the problems the user faces and make them more likely to pay any ransom,” states Trend Micro.
Trend Micro mobile threat response engineer Wish Wu explained that likely the mediaserver service might be affected by other vulnerabilities.
Unfortunately, despite Google admitted the existence of the Android vulnerability, it has rated it with a low priority.
This new vulnerability is the second flaw discovered in less than a week, the previous one in the Stagefright media playback library potentially affected up to 950 million devices.
“Further research into Android – especially the mediaserver service – may find other vulnerabilities that could have more serious consequences to users, including remote code execution. One of them is Stagefright, a recently discovered vulnerability which can infect Android devices using just one MMS.” states the post.
(Security Affairs – Android vulnerability, hacking)
