PT-2016-1873 · Google · Android

Marie Janssen · Published 2016-05-09 · Updated 2016-05-10 · CVE-2016-2439

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions prior to 4.4.4 Android 5.0.x versions prior to 5.0.2 Android 5.1.x versions prior to 5.1.1 Android 6.x versions prior to 2016-05-01

Description The issue is caused by a buffer overflow in the btif/src/btif dm.c component of the Bluetooth functionality in Android. This allows remote attackers to execute arbitrary code via a long PIN value.

Recommendations For Android versions prior to 4.4.4, update to version 4.4.4 or later. For Android 5.0.x versions prior to 5.0.2, update to version 5.0.2 or later. For Android 5.1.x versions prior to 5.1.1, update to version 5.1.1 or later. For Android 6.x versions prior to 2016-05-01, update to a version released after 2016-05-01. As a temporary workaround, consider restricting the use of Bluetooth functionality with long PIN values until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2016-01206

CVE-2016-2439

Affected Products

Android

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-2439 · Security Note
• https://bdu.fstec.ru/vul/2016-01206 · Security Note
• http://source.android.com/security/bulletin/2016-05-01.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2439 · Vendor Advisory
• https://android.googlesource.com/platform/system/bt/+/9b534de2aca5d790c2a1c4d76b545f16137d95dd · Note