CVE-2016-3831 Denial of service in n/a
Remote attackers can crash Android devices by sending a specific NITZ time value, causing a denial of service due to mishandled system clock logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-3831?
CVE-2016-3831 is a high-severity denial of service vulnerability in Google Android, published on 5 Aug 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The telephony component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attackers to cause a denial of service (device crash) via a NITZ time value of 2038-01-19 or later that is mishandled by the system clock, aka internal bug 29083635, related to a "Year 2038 problem."
Weakness: CWE-20
Which versions are affected by CVE-2016-3831?
It affects 1 product.
Products include Google Android.
How do I fix CVE-2016-3831?
No fix has been published for CVE-2016-3831 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-3831 being exploited?
There is no known exploitation of CVE-2016-3831 in the wild and no public exploit code.
Other vulnerabilities in Google Android
Sources
Also known as GHSA-74hv-prrr-hxjg, UBUNTU-CVE-2016-3831.