# MA-501.072015: MyCERT Alert - â€˜Stagefrightâ€™ Android Vulnerability

**Date:** 29 Jul 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-501.072015  
**Advisory ID:** MA-501.072015

---

#### **1.0 Introduction**
Stagefright is the media playback service for Android, introduced in Android 2.2 (Froyo). Stagefright contains multiple vulnerabilities, including several integer overflows, which may allow a remote attacker to execute code on the device. Android devices running Android versions 2.2 through 5.1.1\_r4 contain multiple vulnerabilities in the Stagefright media playback engine. Exploitation of these vulnerabilities may allow an attacker to access multimedia files or potentially take control of a vulnerable device.
**2.0 Impact**
This vulnerability allow a remote attacker to access files or possibly execute code on the device. An attacker with a victim's cell phone number may send maliciously crafted multimedia messages (MMS) which may be improperly parsed by the stagefright media playback engine.
**3.0 Affected Products**
- Devices running Android 2.2 to 5.1.1\_r4
**4.0 StageFright Detection**
There is an Android application called Stagefright Detector created by Lookout. This app can be used to check whether your device is affected by the Stagefright vulnerability. The app is available here:
<https://play.google.com/store/apps/details?id=com.lookout.stagefrightdetector>
**5.0 Recommendations5.1 Apply an update**
Google has released Android 5.1.1\_r5 to address these issues. Note that not all phones with Android 5.1.1 (Lollipop) have this patch applied; patchlevel r5 or above must be installed. The update may or may not be available for your phone. Contact your cell phone carrier or manufacturer for update information.
**5.2 Block all text messages from unknown senders**
Blocking all text messages from unknown senders in your default text message handling app may mitigate this issue.
**5.3Turn off auto-retrieval of multimedia messages**
Note that this does not completely stop the problem, it merely means that you will observe the message and be able to refuse downloading the payload if you do not know who it is from. Below are the steps to disable the auto retrieve feature:
a) Launch your messaging app and open the “Settings” menu.
b) Select the "Multimedia messages" option from the settings menu (for Android versions prior to 5.0, you can skip this step - the menu option from step (c) is actually in this menu).
c) Uncheck “Auto retrieve”.
Note: If you are using Google Hangouts, open the “Settings” menu, click on “SMS” and uncheck the “Auto Retrieve MMS”.
Google Hangouts’ SMS menu
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#03607a6166713a3a3a43607a61667170666076716a777a2d6e7a) or [[email protected]](/cdn-cgi/l/email-protection#2d40544e485f596d40544e485f5903425f4a034054) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**6.0References**
- US-CERT: ‘Stagefright’ Android Vulnerability, [https://www.us-cert.gov/ncas/current-activity/2015/07/28/“Stagefright”-Android-Vulnerability](https://www.us-cert.gov/ncas/current-activity/2015/07/28/)
- Vulnerability Note VU#924951: Android Stagefright contains multiple vulnerabilities, <http://www.kb.cert.org/vuls/id/924951>
<http://www.securityforrealpeople.com/2015/08/avoid-stagefright-by-turning-off-auto.html>
- Stagefright Detector: <https://play.google.com/store/apps/details?id=com.lookout.stagefrightdetector>