Pierluigi Paganini August 19, 2015

CVE-2015-3842 is a new flaw affecting the Android mediaserver, which can be exploited to perform attacks involving arbitrary code execution.

The problems for Android users continue, a long serie of vulnerabilities has been discovered by the experts in the last weeks, Stagefright, zero-day zero-day deserialization, and Certifi-Gate are the names of some of the flaw recently found.

Unfortunately, a new vulnerability (CVE-2015-3842) was discovered by security experts at Trend Micro that once again identified a flaw in the Android’s media server component. The new vulnerability could be exploited remotely to install malicious code on the target device just by sending a specially crafted multimedia message.

The CVE-2015-3842 vulnerability affects all the versions of Android devices including the Android 5.1.1 Lollipop, hundreds of Millions of Android mobile devices are exposed to cyber attacks.

The attacker can trigger a buffer heap overflow due to the lack of checks for the buffer pReplyData and pCmdData.

“The checking of the buffer sizes of pReplyData and pCmdData is not correct. The buffer sizes of both pReplyDataand pCmdData and the buffer pCmdData itself all come from client-supplied parameters. As the mediaserver component uses these buffers, it reads a size coming from the buffer pCmdData; the mediaserver component assumes the buffer sizes of pReplyData and pCmdData are bigger than this size. We can make the buffer size ofpReplyData, which is client-supplied, smaller than the size read from the buffer pCmdData. This causes a heap overflow.” continues the post.

The researchers have released a proof-of-concept (PoC) mobile app that exploits the Android CVE-2015-3842 vulnerability. The app works fine on a Nexus 6 handset running Android 5.1.1 Build LMY47Z.