CVE-2009-2999

CVE-2009-2999 describes a denial-of-service vulnerability in the com.android.phone process of Android 1.5 CRBxx. An attacker can exploit this by sending a specially crafted SMS message containing a malformed WAP Push message, leading to an ArrayIndexOutOfBoundsException. This results in the affected Android device's application restarting and network disconnection. The vulnerability has a CVSS score of 4.3, indicating a medium severity. It can be exploited remotely with medium attack complexity, requiring no authentication, and primarily impacts availability. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Despite this, the CVE has garnered significant community discussion, with 10 mentions, suggesting awareness among security researchers.