Issue
After upgrading to Android 5.0, applications relying on the MD5 cipher on invocation.
Resolution
In lollipop, MD5 related functions have been removed from libc. The app needs to verify it's references to MD5 related functions from it's code.
As of Android 5.0, as a developer you must include sources for MD5 related functions directly in your library, or link static library which has those functions. This would be as a result of changes to libc for Android 5.0.
For more information about libraries in API Level 19 and 21:
LIBC Functions in Android API Level 21: https://android.googlesource.com/platform/development/+/e5ede93a47885b9ac9d0ccb72c0ef4ad0d655547/ndk/platforms/android-21/arch-p/symbols/libc.so.functions.txt
LIBC Functions in Android API Level 19: https://android.googlesource.com/platform/development/+/797351fd3bbb8fe517afafdd5095fd740387e7a4/ndk/platforms/android-19/arch-x86/symbols/libc.so.functions.txt
Keywords: Security, libc, MD5, SHA1
[KB_0023]
