Digital Trends describes the Stagefright Vulnerability thus:

The exploit in question happens when a hacker sends a MMS message containing a video that includes malware code. What’s most alarming about it is that the victim doesn’t even have to open the message or watch the video in order to activate it. The built-in Hangouts app automatically processes videos and pictures from MMS messages in order to have them ready in the phone’s Gallery app.

How is it that a video file that hasn't been 'played' yet can be used to execute malicious code? Would anyone be able to give a more low-level explanation of how this is possible?

P.S.: To protect yourself just make sure to disable all the 'Auto-Download' features for MMS in your messaging apps (Hangout, Messaging, etc.).

  • I guess you are right, I was just surprised that this is such a wide-ranging exploit, yet barely anyone knows how it works... – PositriesElectron Jul 28 '15 at 14:02
  • 2
    Certain apps such as Google Hangouts do pre-processing on media before you actually look at it, so that increases the vulnerability – David Grinberg Jul 28 '15 at 17:40
  • Here is some information updated 3 days ago -- github.com/fuzzing/MFFA – atdre Jul 29 '15 at 15:41
  • How the bug being attach in the mp4 file and how do the attacker determine the return address on incoming connection??? Please answer . – user107062 Apr 10 '16 at 7:00
up vote 46 down vote accepted

The details will be released on the 5th of august. However, on the Cyanogenmod github repository there are several interesting details that appear to be related: it appears that certain fields in 3GPP video metadata are vulnerable to buffer overflow attacks. In short, a 3GPP video can be given a string of metadata that, at first, exceeds a certain length, and in the end includes machine code that lands in memory that is off-limits to the application.

Update: Cyanogenmod has released a patch for this vulnerability.

  • 3
    Also, maybe this and this changes could be relevant. – Tomer Jul 28 '15 at 14:13
  • 9
    It's especially worth noting that the person committing those changes is the person who disclosed the vulns, so it's a fair bet this is it... – Rоry McCune Jul 28 '15 at 14:23
  • 2
    Just curious, isn't fuzz testing performed on Android? If so, how do things like this not get caught? – dramzy Jul 28 '15 at 17:27
  • 9
    @RespectMyAuthoritah Good question. From my experience in systems software QA, though, if you asked it of 100 software testers, one of them would say "Of course not! Are you nuts?" and the other 99 would say "What's fuzz testing?" – dodgethesteamroller Jul 28 '15 at 22:18
  • 2
    Now that the 5th of August has been and gone, is there any further information? – James_pic Aug 24 '15 at 13:47

In addition to the commits shown on github, Trend Labs have also posted a more detailed explanation of the integer overflow vulnerability (CVE-2015-3824) on their security blog. They demonstrate how it can be exploited from within an app, from a URL, and using MMS messages.

EDIT: I was able to create an MP4 file that crashes my mediaserver process using this vulnerability. You're supposed to see it inside logcat.

Update: As of 2016, there are now very detailed explanations and exploitations of this vulnerability. Look at the great Metaphor exploit paper for example.

protected by Community Apr 10 '16 at 17:43

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.