Android security: Google kills remote hacker bug, patches seven critical flaws
This month's fixes were shared with Android partners on January 4 but so far only BlackBerry has issued a patch.
Google has fixed a critical bug in Android that can be remotely exploited by an email, MMS, or link to a webpage that contains a specially-crafted media file.
Of the seven critical security vulnerabilities in Google's February patch for Android Nexus devices, the fix for the most serious flaws affects the mediaserver service in the OS.
This service contained two flaws exposing devices to remote execution when the mediaserver processes a purpose-built file delivered by email, MMS, or a webpage.
The flaws affect Android 6.0, Android 5.1 Lollipop, and Android 4.4.4 KitKat.
Google notes that one mitigation is that its Google Hangouts and Messenger apps no longer automatically pass media to the mediaserver, a measure it took last August to prevent Stagefright attacks.
ANDROID SECURITY
This month's fixes were shared with Android partners on January 4. However, so far the only vendor to have patched the issue is BlackBerry, which released an update for PRIV Android handsets within 24 hours of Google's over-the-air update for Nexus handsets on Monday.
Google also addressed a pair of equally serious bugs in the Broadcom Wi-Fi driver that allow an attacker on the same Wi-Fi network to corrupt kernel memory.
"Multiple remote execution vulnerabilities in the Broadcom Wi-Fi driver could allow a remote attacker to use specially-crafted wireless control message packets to corrupt kernel memory in a way that leads to remote code execution in the context of the kernel," Google notes.
Overall, the February update addresses 13 security bugs, of which seven are critical, four high severity, and two moderate.
The fixes bring Google's Android Security Patch Level up to February 1, 2016, which Android OEMs such as Samsung, LG, Sony, and others should be rolling in the coming month at least to flagship handsets.
Samsung released its January fixes roughly three weeks after Google fixed its Nexus devices.
Android 6.0 and firmware builds LMY49G or later for Nexus devices, which are available on Google's developer site, address the issues.
The update marks the seventh monthly patch Google has released since committing to regular patching last August.
The company revealed last week that it had paid Android security researchers a total of $200,000 in bounties since launching its program last June.