CVE-2016-6691: Critical severity Google Android vulnerability
service/jni/comandroidserverwifiGbk2Utf.cpp in the Qualcomm Wi-Fi gbk2utf module in Android before 2016-10-05 allows remote attackers to cause a denial of service (framework crash) or possibly have unspecified other impact via an access point that has a malformed SSID with GBK encoding, aka Qualcomm internal bug CR 978452.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is exposed to this issue?
Android devices that include the Qualcomm Wi-Fi gbk2utf module and have not received the available patch are exposed when they encounter a malicious access point advertising a malformed GBK-encoded SSID.
What does an attacker need to exploit it?
An attacker needs to operate or present an access point with a malformed SSID using GBK encoding. No authentication, user interaction, or prior privileges are required according to the supplied severity vector.
How can I determine whether a device is affected?
Verify whether the device uses the Qualcomm Wi-Fi gbk2utf module and whether it has incorporated the patch associated with Qualcomm internal bug CR 978452. The issue affects Android versions before the 2016-10-05 fix date.
What should be done if patching cannot happen immediately?
Avoid connecting to or scanning untrusted wireless networks where possible, since exploitation is triggered by a malicious access point's advertised SSID. Apply the available patch as soon as practical.