CVE-2015-3864

Description

Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Android Stagefright MP4 tx3g Integer Overflow
exploit/android/browser/stagefright_mp4_tx3g_64bit

Exploit-DB 3

Google Android 5.0 < 5.1.1 - 'Stagefright' .MP4 tx3g Integer Overflow (Metasploit) EDB-40436 · remote · Sep 27, 2016 · verified
Google Android 5.0.1 - Metaphor Stagefright (ASLR Bypass) EDB-39640 · remote · Mar 30, 2016
Google Android - libstagefright Integer Overflow Remote Code Execution EDB-38226 · remote · Sep 17, 2015 · verified

GitHub 5 repositories

eudemonics/scaredycat ★ 17 · Dec 8, 2015

Python script to generate a malicious MP4 file and start a CherryPy web server hosting a simple HTML page with the embedded file. Exploits another Stagefright vulnerability, the integer overflow (CVE…
pwnaccelerator/stagefright-cve-2015-3864 ★ 3 · Aug 18, 2015

PoC - Binary patches for CVE-2015-3864 (NOT for production, use at your own risk)
Cmadhushanka/CVE-2015-3864-Exploitation ★ 0 · Jul 10, 2024

year 2 semester 1 Systems and Network Programming Assignment
Bhathiya404/Exploiting-Stagefright-Vulnerability-CVE-2015-3864 ★ 0 · Feb 9, 2023
HenryVHuang/CVE-2015-3864 ★ 0 · Sep 30, 2016

just some research notes

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References

[android-security-updates] 20150909 Nexus Security Bulletin (September 2015) mailing-list
https://blog.zimperium.com/cve-2015-3864-metasploit-module-now-available-for-testing/
https://android.googlesource.com/platform/frameworks/av/+/6fe85f7e15203e48df2cc3e8e1c4bc6ad49dc968
38226 exploit
76682 vdb-entry
https://blog.zimperium.com/reflecting-on-stagefright-patches/
40436 exploit
39640 exploit