Vulnerability Details : CVE-2016-3888
internal/telephony/SMSDispatcher.java in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism, and send premium SMS messages during the Setup Wizard provisioning stage, via unspecified vectors, aka internal bug 29420123.
Published
2016-09-11 21:59:33
Updated
2017-08-13 01:29:09
Products affected by CVE-2016-3888
- cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-3888
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 22 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-3888
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:P/A:N |
3.9
|
2.9
|
NIST | |
|
2.1
|
LOW | CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
0.7
|
1.4
|
NIST |
CWE ids for CVE-2016-3888
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-3888
-
http://www.securitytracker.com/id/1036763
Google Android Multiple Flaws Let Remote Users Deny Service and Execute Arbitrary Code and Let Applications Obtain Potentially Sensitive Information and Gain Elevated Privileges - SecurityTracker
-
http://www.securityfocus.com/bid/92857
Google Android CVE-2016-3888 Local Privilege Escalation Vulnerability
-
http://source.android.com/security/bulletin/2016-09-01.html
Android Security Bulletin—September 2016 | Android Open Source ProjectVendor Advisory
-
https://android.googlesource.com/platform/frameworks/opt/telephony/+/b8d1aee993dcc565e6576b2f2439a8f5a507cff6
b8d1aee993dcc565e6576b2f2439a8f5a507cff6 - platform/frameworks/opt/telephony - Git at GoogleIssue Tracking;Patch
Jump to