Trend Micro has discovered vulnerability in Android that can render a phone apparently dead and silent, unable to make calls, with a lifeless screen. This vulnerability is present from Android 4.3 Jelly Bean up to the current version, Android 5.1.1 Lollipop. No patch has been issued in the Android Open Source Project (AOSP) code by the Android Engineering Team to fix this vulnerability since May 2015.
This vulnerability can be exploited in two ways – either via a malicious app installed on the device, or through a specially-crafted website. The first technique can cause long-term effects to the device. In this technique, an app with an embedded MKV file that registers itself to auto-start whenever the device boots would case the OS to crash every time it is turned on.
The vulnerability is caused by an integer overflow when the media server service parses an MKV file. It reads memory out of buffer or writes data to NULL address when parsing audio data…Read more