Shortly after the events in Las Vegas, researchers from Exodus Intelligence discovered a problem with one of the patches Joshua supplied. In the meantime, updates addressing the initial set of issues we disclosed continue to roll out to affected devices. Now that we are facing additional vulnerabilities, we’ll see for ourselves if our devices get these updates or not. Industry leading vendors clearly stated that they intend to provide security updates on a monthly basis. The most positive thing about our Stagefright research is waking the ecosystem and getting device vendors and carriers to realize they must distribute updates more quickly and more often. We applaud the efforts of myriad researchers that flocked to audit the Android code base and collectively discovered and reported numerous additional issues. That said, we did not expect the incredible level of response from the community. We expected other researchers to explore the vulnerabilities we disclosed and discover additional vulnerabilities in the Stagefright library over time. With these other vectors still present, the importance of fixing issues within the code base remains very high. However, this attack vector constituted only the worst of more than 10 different ways (browsers, instant messengers, etc) potentially malicious media is processed by the Stagefright library. We’ve tested these updated versions and are happy to confirm they prevent unassisted remote exploitation. Google released new versions of Hangouts and Messenger to block automatic processing of multimedia files arriving via MMS.

Unassisted Remote Attack Vector Addressed.Please review these materials to learn more about Joshua’s research straight from the source. Later, the Black Hat organizers made the full video available on YouTube. We made Joshua’s presentation slides available shortly after Black Hat and DEF CON. Before we dive into our exploit, let’s recap the key events that unfolded since our recent announcement. Multiple researchers have publicly discussed their own working exploits targeting vulnerabilities within libstagefright. After discussions with ZHA Partners, including both carriers and device manufacturers, we agreed to postpone the release of the exploit until August 24th. In July, we announced our intentions to publish our exploit on August 5th during Black Hat USA. Back in April and May we reported two sets of vulnerabilities to Google, both including multiple with critical severity. In that time frame, the number and importance of the events that have unfolded is nothing short of amazing. Drake ’s discovery of multiple critical vulnerabilities in Android’s media library – libstagefright. More than a month has passed since Zimperium first broke the news of zLabs ’ VP of Platform Research and Exploitation Joshua J.

What is stagefright vulnerability