SID 1:52288

Rule Category

OS-MOBILE -- Snort has detected traffic targeting vulnerabilities in a mobile-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself.

Alert Message

OS-MOBILE Google Android libstagefright integer underflow attempt

Rule Explanation

This event is generated when a malicious MPEG-4 file attempts to trigger an integer overflow in Android's libstagefright library. Impact: High Details: Android's Stagefright library is a core library used for playing multimedia formats. It is in this library that an integer overflow vulnerable exists due to the MPEG4Extractor::parseChunk function located in the MPEG4Extractor.cpp failing to properly validate the size of the chunks specified by a MPEG-4 file. Attackers are then able to trigger the vulnerability via a specially crafted MPEG-4 file and achieve arbitrary code execution. Ease of Attack: Simple

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group