Google has released a security update for Android
Google has released an update for Android, which closes a number of vulnerabilities in various components of the OS. As part of the Nexus Security Bulletin update - October 2015, the company fixed 30 unique vulnerabilities, including the Stagefright 2.0 vulnerability, which we wrote about in more detail here . Vulnerabilities are present in the libstagefright system component and allow an attacker to remotely execute Android code with maximum system privileges.
The new update for Android is the third in a row, in which Google is trying to save users from vulnerabilities such as Stagefright. Previous updates have closed in Android a critical for users method of exploiting vulnerabilities using a multimedia MMS message, when he doesn’t even need to open the message itself, and the exploit works immediately after the message arrives. This month's update closes another exploitation vector - using a mobile web browser.
Vulnerabilities like RCE in the system components of Android are very dangerous because they allow attackers to execute code in the system with maximum permissions, i.e., to get full control over the device. The following vulnerabilities in components such as libstagefright , Sonivox , libutils , Skia , libFLAC are of this type. As we wrote earlier, multiple vulnerabilities in the libstagefright library allow attackers to remotely execute code on a device by luring the user to play specially crafted MP3 and MP4 files (in the context of the mediaserver service). A link to a web page with malicious content can be sent to the user via SMS or e-mail. Almost all fixes vulnerabilities are relevant for versions of Android 5.1 and below (all versions).
')
The same applies to the other libraries and components listed above ( Sonivox , libutils , Skia , libFLAC ), they allow an attacker to remotely execute code on a user's device with maximum rights in the system, since they are used by the mediaserver system service.
Other vulnerabilities in system components can be used by attackers to enhance their privileges in the system. For example, a vulnerability in the Bluetooth component allows an application to delete SMS messages stored in the device’s memory.
We recommend that users of devices running Android install the appropriate update.
be secure.
The new update for Android is the third in a row, in which Google is trying to save users from vulnerabilities such as Stagefright. Previous updates have closed in Android a critical for users method of exploiting vulnerabilities using a multimedia MMS message, when he doesn’t even need to open the message itself, and the exploit works immediately after the message arrives. This month's update closes another exploitation vector - using a mobile web browser.
Vulnerabilities like RCE in the system components of Android are very dangerous because they allow attackers to execute code in the system with maximum permissions, i.e., to get full control over the device. The following vulnerabilities in components such as libstagefright , Sonivox , libutils , Skia , libFLAC are of this type. As we wrote earlier, multiple vulnerabilities in the libstagefright library allow attackers to remotely execute code on a device by luring the user to play specially crafted MP3 and MP4 files (in the context of the mediaserver service). A link to a web page with malicious content can be sent to the user via SMS or e-mail. Almost all fixes vulnerabilities are relevant for versions of Android 5.1 and below (all versions).
')
The same applies to the other libraries and components listed above ( Sonivox , libutils , Skia , libFLAC ), they allow an attacker to remotely execute code on a user's device with maximum rights in the system, since they are used by the mediaserver system service.
Other vulnerabilities in system components can be used by attackers to enhance their privileges in the system. For example, a vulnerability in the Bluetooth component allows an application to delete SMS messages stored in the device’s memory.
We recommend that users of devices running Android install the appropriate update.
be secure.
Source: https://habr.com/ru/post/268291/
All Articles