1. CVE-Search
  2. CVE-2016-7989
ID CVE-2016-7989
Summary On Samsung Galaxy S4 through S7 devices, a malformed OTA WAP PUSH SMS containing an OMACP message sent remotely triggers an unhandled ArrayIndexOutOfBoundsException in Samsung's implementation of the WifiServiceImpl class within wifi-service.jar. This causes the Android runtime to continually crash, rendering the device unusable until a factory reset is performed, a subset of SVE-2016-6542.
References
Vulnerable Configurations
  • cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*
    cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*
  • cpe:2.3:h:samsung:galaxy_s4:-:*:*:*:*:*:*:*
    cpe:2.3:h:samsung:galaxy_s4:-:*:*:*:*:*:*:*
  • cpe:2.3:h:samsung:galaxy_s4_mini:-:*:*:*:*:*:*:*
    cpe:2.3:h:samsung:galaxy_s4_mini:-:*:*:*:*:*:*:*
  • cpe:2.3:h:samsung:galaxy_s5:-:*:*:*:*:*:*:*
    cpe:2.3:h:samsung:galaxy_s5:-:*:*:*:*:*:*:*
  • cpe:2.3:h:samsung:galaxy_s6:-:*:*:*:*:*:*:*
    cpe:2.3:h:samsung:galaxy_s6:-:*:*:*:*:*:*:*
  • cpe:2.3:h:samsung:galaxy_s7:-:*:*:*:*:*:*:*
    cpe:2.3:h:samsung:galaxy_s7:-:*:*:*:*:*:*:*
CVSS
Base: 7.8 (as of 02-12-2016 - 23:05)
Impact:
Exploitability:
CWE CWE-254
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:C
refmap via4
bid 94082
confirm http://security.samsungmobile.com/smrupdate.html#SMR-AUG-2016
Last major update 02-12-2016 - 23:05
Published 31-10-2016 - 10:59
Last modified 02-12-2016 - 23:05
Back to Top