Android devices could be hacked by playing a video due to CVE-2019
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-2107 | In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check. In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130024844. NVD description · AI analysis pending | 8.8 | 9% |
| — |
Full article324 words · extracted from securityaffairs.com · click to collapse
Watch out! Playing a video on Android devices could be a dangerous operation due to a critical CVE-2019-2107 RCE flaw in Android OS between version 7.0 and 9.0.
Playing a specially-crafted video on devices with the Android’s native video player application could allow attackers to compromise them due to a dangerous critical remote code execution flaw. The vulnerability, tracked as CVE-2019-2107, affected Android OS between version 7.0 and 9.0 (Nougat, Oreo, or Pie) potentially impacting over 1 billion devices.
The RCE flaw CVE-2019-2107 resides in the Android media framework.
Google already addressed the flaw with July 2019 Android Security Bulletin, but millions of devices still waiting for the patch to be released by their manufacturers.
“The most severe vulnerability in this section [media framework] could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process,” reads the security advisory.
The Android developer Marcin Kozlowski has also published a proof-of-concept code to exploit this flaw.
The
PoCcode, an HEVC encoded video, could allow an attacker to crash the media player. Potentially an attacker could develop an exploit to remotely execute arbitrary code.
However, it should be noted that if such malicious videos are received through an instant messaging app like WhatsApp or Facebook
Messenger oruploaded
ona service like YouTube or Twitter, the attack won’t work.
“CVE-2019-2107 – looks scary. Still remember Stagefright and PNG bugs vulns …. With CVE-2019-2107 the decoder/codec runs under mediacodec user and with properly “crafted” video (with tiles enabled – ps_pps->i1_tiles_enabled_flag) you can possibly do RCE. The codec affected is HVEC (a.k.a H.265 and MPEG-H Part 2)” wrote Kozlowski.
To prevent the exploitation of this flaw, users have to update their Android versions by applying the latest security patches. Of course, they have to avoid downloading and playing videos from untrusted sources
[adrotate banner=”9″][adrotate banner=”12″]
(SecurityAffairs – CVE-2019-2107, Android)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/89027/hacking/android-rce-cve-2019-2107.html