Skip to content

Commit 0927ac3

Browse files
Fuzion24Fuzion24
committed
Merge pull request #100 from Fuzion24/feature/cve_2015_6616
CVE-2015-6616
2 parents c18c168 + ca53370 commit 0927ac3

File tree

3 files changed

+102
-0
lines changed

3 files changed

+102
-0
lines changed

‎app/src/main/assets/vuln_map.json

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -507,5 +507,29 @@
507507
"https://android.googlesource.com/platform%2Fframeworks%2Fav/+/3878b990f7d53eae7c2cf9246b6ef2db5a049872"
508508
],
509509
"cvedate": "09/30/2015"
510+
},
511+
"CVE-2015-6616": {
512+
"cve": "CVE-2015-6616",
513+
"altnames": [
514+
"ANDROID-24630158",
515+
"ANDROID-23882800",
516+
"ANDROID-17769851",
517+
"ANDROID-24441553",
518+
"ANDROID-24157524"
519+
],
520+
"description": "Remote Code Execution Vulnerabilities in Mediaserver",
521+
"impact": "During media file and data processing of a specially crafted file, vulnerabilities in mediaserver could allow an attacker to cause memory corruption and remote code execution as the mediaserver process. The affected functionality is provided as a core part of the operating system and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media. This issue is rated as a Critical severity due to the possibility of remote code execution within the context of the mediaserver service. The mediaserver service has access to audio and video streams as well as access to privileges that third-party apps cannot normally access.",
522+
"external_links": [
523+
"https://source.android.com/security/bulletin/2015-12-01.html"
524+
],
525+
"cvssv2": 10,
526+
"patch": [
527+
"https://android.googlesource.com/platform%2Fframeworks%2Fav/+/77c185d5499d6174e7a97b3e1512994d3a803151",
528+
"https://android.googlesource.com/platform%2Fframeworks%2Fav/+/0d35dd2068d6422c3c77fb68f248cbabf3d0b10c",
529+
"https://android.googlesource.com/platform%2Fframeworks%2Fav/+/dedaca6f04ac9f95fabe3b64d44cd1a2050f079e",
530+
"https://android.googlesource.com/platform%2Fframeworks%2Fav/+/5d101298d8b0a78a1dc5bd26dbdada411f4ecd4d",
531+
"https://android.googlesource.com/platform%2Fexternal%2Flibavc/+/2ee0c1bced131ffb06d1b430b08a202cd3a52005"
532+
],
533+
"cvedate": "10/12/2015"
510534
}
511535
}

‎app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/VulnerabilityOrganizer.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import fuzion24.device.vulnerability.vulnerabilities.framework.graphics.GraphicBufferTest;
1313
import fuzion24.device.vulnerability.vulnerabilities.framework.media.CVE_2015_6602;
1414
import fuzion24.device.vulnerability.vulnerabilities.framework.media.CVE_2015_6608;
15+
import fuzion24.device.vulnerability.vulnerabilities.framework.media.CVE_2015_6616;
1516
import fuzion24.device.vulnerability.vulnerabilities.framework.media.StageFright;
1617
import fuzion24.device.vulnerability.vulnerabilities.framework.serialization.OpenSSLTransientBug;
1718
import fuzion24.device.vulnerability.vulnerabilities.framework.zip.ZipBug8219321;
@@ -53,6 +54,7 @@ public static List<VulnerabilityTest> getTests(Context ctx){
5354
allTests.add(new SamsungCREDzip());
5455
allTests.add(new CVE_2015_6608());
5556
allTests.add(new CVE20151528());
57+
allTests.add(new CVE_2015_6616());
5658

5759
List<VulnerabilityTest> filteredTest = new ArrayList<VulnerabilityTest>();
5860
String cpuArch1 = SystemUtils.propertyGet(ctx, "ro.product.cpu.abi");

‎app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/framework/media/CVE_2015_6616.java

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
package fuzion24.device.vulnerability.vulnerabilities.framework.media;
2+
3+
import android.content.Context;
4+
5+
import java.io.ByteArrayOutputStream;
6+
import java.io.File;
7+
import java.io.FileInputStream;
8+
import java.util.ArrayList;
9+
import java.util.List;
10+
11+
import fuzion24.device.vulnerability.util.CPUArch;
12+
import fuzion24.device.vulnerability.vulnerabilities.VulnerabilityTest;
13+
import fuzion24.device.vulnerability.vulnerabilities.helper.BinaryAssets;
14+
import fuzion24.device.vulnerability.vulnerabilities.helper.KMPMatch;
15+
16+
/**
17+
* Created by fuzion24 on 12/14/15.
18+
*/
19+
public class CVE_2015_6616 implements VulnerabilityTest {
20+
21+
/*
22+
CVE Bug(s) with AOSP links Severity Affected versions Date reported
23+
CVE-2015-6616
24+
ANDROID-24630158 Critical 6.0 and below Google Internal
25+
ANDROID-23882800 Critical 6.0 and below Google Internal
26+
ANDROID-17769851 Critical 5.1 and below Google Internal
27+
ANDROID-24441553 Critical 6.0 and below Sep 22, 2015
28+
ANDROID-24157524 Critical 6.0 Sep 08, 2015
29+
30+
ANDROID-24630158 https://android.googlesource.com/platform%2Fframeworks%2Fav/+/77c185d5499d6174e7a97b3e1512994d3a803151
31+
ANDROID-23882800 https://android.googlesource.com/platform%2Fframeworks%2Fav/+/0d35dd2068d6422c3c77fb68f248cbabf3d0b10c
32+
ANDROID-17769851 https://android.googlesource.com/platform%2Fframeworks%2Fav/+/dedaca6f04ac9f95fabe3b64d44cd1a2050f079e
33+
ANDROID-24441553 https://android.googlesource.com/platform%2Fframeworks%2Fav/+/5d101298d8b0a78a1dc5bd26dbdada411f4ecd4d
34+
ANDROID-24157524 https://android.googlesource.com/platform%2Fexternal%2Flibavc/+/2ee0c1bced131ffb06d1b430b08a202cd3a52005
35+
*/
36+
37+
@Override
38+
public String getCVEorID() {
39+
return "CVE-2015-6616";
40+
}
41+
42+
@Override
43+
public boolean isVulnerable(Context context) throws Exception {
44+
File stagefrightlib = new File("/system/lib/libstagefright.so");
45+
if(!stagefrightlib.exists() || !stagefrightlib.isFile()){
46+
throw new Exception("libstagefright.so doesn't exist or is not a file");
47+
}
48+
49+
ByteArrayOutputStream libStageFrightBAOS = new ByteArrayOutputStream((int)stagefrightlib.length());
50+
BinaryAssets.copy(new FileInputStream(stagefrightlib), libStageFrightBAOS);
51+
byte[] libstagefrightSO = libStageFrightBAOS.toByteArray();
52+
53+
KMPMatch binMatcher = new KMPMatch();
54+
55+
int indexOf = binMatcher.indexOf(libstagefrightSO, "b/24445127".getBytes());
56+
boolean libstagefrightVulnerableToBug24445127 = indexOf == -1;
57+
58+
indexOf = binMatcher.indexOf(libstagefrightSO, "bogus max input size: %zu".getBytes());
59+
boolean libstagefrightVulnerableToBug17769851 = indexOf == -1;
60+
61+
indexOf = binMatcher.indexOf(libstagefrightSO, "b/24441553, b/24445122".getBytes());
62+
boolean libstagefrightVulnerableToBug24441553 = indexOf == -1;
63+
64+
65+
return libstagefrightVulnerableToBug24445127 ||
66+
libstagefrightVulnerableToBug17769851 ||
67+
libstagefrightVulnerableToBug24441553;
68+
}
69+
70+
@Override
71+
public List<CPUArch> getSupportedArchitectures() {
72+
List<CPUArch> archs = new ArrayList<>();
73+
archs.add(CPUArch.ALL);
74+
return archs;
75+
}
76+
}

0 commit comments

Comments
 (0)