Siemens S55 Cellular Telephone SMS Confirmation Message Bypass Vulnerability

Bugtraq ID:	10227
Class:	Race Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 27 2004 12:00AM
Updated:	Apr 27 2004 12:00AM
Credit:	Discover of this issue is credited to FtR <[email protected]> and FX <[email protected]>
Vulnerable:	Siemens S55
Not Vulnerable:

Siemens S55 Cellular Telephone SMS Confirmation Message Bypass Vulnerability

Reportedly the Siemens S55 is affected by an SMS confirmation message bypass vulnerability. This issue is due to a race condition error that allows a malicious programmer to send SMS messages from unsuspecting cellular telephone user's telephones while obscuring the confirmation request.

This issue may allow a malicious programmer to develop an application that can send SMS messages without the cellular telephone user's knowledge.

Siemens S55 Cellular Telephone SMS Confirmation Message Bypass Vulnerability

The following exploit has been provided:

• /data/vulnerabilities/exploits/siemensS55JavaSMSExploit.java

Siemens S55 Cellular Telephone SMS Confirmation Message Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Siemens S55 Cellular Telephone SMS Confirmation Message Bypass Vulnerability

References:

• Mobile phone homepage (Siemens)