Google came out with its monthly Android security update, and once again, there is a fix for Stagefright (technically libstagefright) vulnerabilities. In total, Google is providing patches for 18 uniquely identified Common Vulnerabilities and Exposures (CVEs).
Google first committed to issue monthly Android updates in August in the aftermath of the initial disclosure around Stagefright. The initial Stagefright vulnerabilities were first publicly disclosed in July by Joshua Drake, vice president of Platform Research and Exploitation at Zimperium zLabs.
From a technical perspective, libstagefright is a media library that has been a common part of Google’s mobile operating system since the Android 2.2 release. Google patched the initial set of libstagefright flaws that Drake reported in August, but additional flaws have been revealed in the intervening months. In Google’s October Android update, 19 vulnerabilities were patched, including multiple Stagefright issues, and the company patched even more Stagefright bugs in its November Android update.
In the December Android update, Google is patching four new libstagefright vulnerabilities. One is CVE-2015-6620, a privilege escalation flaw in libstagefright that was first reported to Google on Sept. 2, 2015.
The December Android update also includes patches for three information disclosure vulnerabilities: CVE-2015-6626, CVE-2015-6631 and CVE-2015-6632. The CVE-2015-6631 issue was first reported to Google on Aug. 21 while CVE-2015-6626 was reported on Sept. 2. Google is not disclosing the date that CVE-2015-6632 was reported.
“There are information disclosure vulnerabilities in libstagefright that during communication with the mediaserver could permit a bypass of security measures in place to increase the difficulty of attackers exploiting the platform,” Google’s advisory warns about the three information disclosure vulnerabilities.
The fact that Google is still patching the libstagefright flaws five months after the first flaws were reported and publicly discussed isn’t all that unusual. In November, Drake told eWEEK that when he first examined the libstagefright code, it was clear to him that the code was written without much concern for security, safety or robustness.
“It will take time and sustained effort to clean it up,” Drake said.
The Stagefright vulnerability that first made headlines in July and was the subject of a Black Hat talk in August is a complex issue that exists deep within Android. It’s not a single issue—it’s many—and untangling the mess and making Android more secure is going to take Google time. No one should be too surprised if there are still libstagefright flaws patched by Google in the January 2016 Android update.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.