BlueSoleil Object Push Service Bluetooth File Upload Directory Traversal Vulnerability

Bugtraq ID:	12961
Class:	Access Validation Error
CVE:	CVE-2005-0978
Remote:	Yes
Local:	No
Published:	Apr 01 2005 12:00AM
Updated:	Jul 12 2009 11:56AM
Credit:	Discovery is credited to Kevin Finisterre.
Vulnerable:	IVT BlueSoleil 1.4
Not Vulnerable:

BlueSoleil Object Push Service Bluetooth File Upload Directory Traversal Vulnerability

BlueSoleil is prone to directory traversal attacks during Bluetooth file uploads. The issue exists in the Object Push Service.

This vulnerability may allow an attacker to upload malicious files to arbitrary locations on affected computers over Bluetooth. An attacker can take advantage of the issue to execute arbitrary code by uploading executables to a location on the computer where they will later be executed.

BlueSoleil Object Push Service Bluetooth File Upload Directory Traversal Vulnerability

This vulnerability has been demonstrated by modifying the obextool.c source file from ussp-push-0.2 as follows:

@@ -316,7 +316,7 @@
}

filename = argv[1];
- alias = basename(filename);
+ alias = "../../../../../../../../mal.exe";
str2ba(argv[2], &bdaddr);
channel = (argc > 3) ? atoi(argv[3]) : 10;

The modified obextool client may then be used to push a malicious file to a target computer.

BlueSoleil Object Push Service Bluetooth File Upload Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

BlueSoleil Object Push Service Bluetooth File Upload Directory Traversal Vulnerability

References:

• BlueSoleil Homepage (IVT)
  
• DMA[2005-0401a] - 'IVT BlueSoleil Directory Transversal' (Kevin Finisterre)