Nokia Affix BTFTP Client Filename Remote Buffer Overflow Vulnerability

Bugtraq ID:	14230
Class:	Boundary Condition Error
CVE:	CVE-2005-2250
Remote:	Yes
Local:	No
Published:	Jul 12 2005 12:00AM
Updated:	Jul 12 2009 04:06PM
Credit:	Discovery of this issue is credited to Kevin Finisterre.
Vulnerable:	Nokia Affix 3.2 Nokia Affix 3.1 Nokia Affix 3.0 Nokia Affix 2.1.2 Nokia Affix 2.1.1 - Debian Linux 3.1 sparc - Debian Linux 3.1 s/390 - Debian Linux 3.1 ppc - Debian Linux 3.1 mipsel - Debian Linux 3.1 mips - Debian Linux 3.1 m68k - Debian Linux 3.1 ia-64 - Debian Linux 3.1 ia-32 - Debian Linux 3.1 hppa - Debian Linux 3.1 arm - Debian Linux 3.1 amd64 - Debian Linux 3.1 alpha - Debian Linux 3.1 Nokia Affix 2.1 - Debian Linux 3.1 sparc - Debian Linux 3.1 s/390 - Debian Linux 3.1 ppc - Debian Linux 3.1 mipsel - Debian Linux 3.1 mips - Debian Linux 3.1 m68k - Debian Linux 3.1 ia-64 - Debian Linux 3.1 ia-32 - Debian Linux 3.1 hppa - Debian Linux 3.1 arm - Debian Linux 3.1 alpha - Debian Linux 3.1 Nokia Affix 2.0.2 Nokia Affix 2.0.1 Nokia Affix 2.0 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1
Not Vulnerable:

Nokia Affix BTFTP Client Filename Remote Buffer Overflow Vulnerability

The Nokia Affix btftp client software is prone to a remote client-side buffer overflow vulnerability. The issue exists due to a lack of sufficient boundary checks that are performed on filename data before this data is copied into a finite memory buffer.

This issue may be exploited by an attacker that is under control of an OBEX File Transfer server, to execute arbitrary code in the context of the affected clients that connect to the malicious server, and request a directory listing.

Nokia Affix BTFTP Client Filename Remote Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Nokia Affix BTFTP Client Filename Remote Buffer Overflow Vulnerability

Solution:
Debian has released advisory DSA 762-1 to address this issue. Please see the attached advisory for details on obtaining and applying fixes.

Debian has released security advisory DSA 773-1 addressing several issues for their AMD64 port of the operating system. Please see the referenced advisory for further information.

The vendor has released patches:


Nokia Affix 2.1

• Debian affix_2.1.1-2_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_alp ha.deb


• Debian affix_2.1.1-2_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_arm .deb


• Debian affix_2.1.1-2_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_hpp a.deb


• Debian affix_2.1.1-2_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_i38 6.deb


• Debian affix_2.1.1-2_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_ia6 4.deb


• Debian affix_2.1.1-2_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_m68 k.deb


• Debian affix_2.1.1-2_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_mip s.deb


• Debian affix_2.1.1-2_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_mip sel.deb


• Debian affix_2.1.1-2_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_pow erpc.deb


• Debian affix_2.1.1-2_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_s39 0.deb


• Debian affix_2.1.1-2_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_spa rc.deb


• Debian libaffix-dev_2.1.1-2_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_alpha.deb


• Debian libaffix-dev_2.1.1-2_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_arm.deb


• Debian libaffix-dev_2.1.1-2_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_hppa.deb


• Debian libaffix-dev_2.1.1-2_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_i386.deb


• Debian libaffix-dev_2.1.1-2_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_ia64.deb


• Debian libaffix-dev_2.1.1-2_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_m68k.deb


• Debian libaffix-dev_2.1.1-2_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_mips.deb


• Debian libaffix-dev_2.1.1-2_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_mipsel.deb


• Debian libaffix-dev_2.1.1-2_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_powerpc.deb


• Debian libaffix-dev_2.1.1-2_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_s390.deb


• Debian libaffix-dev_2.1.1-2_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_sparc.deb


• Debian libaffix2_2.1.1-2_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _alpha.deb


• Debian libaffix2_2.1.1-2_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _arm.deb


• Debian libaffix2_2.1.1-2_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _hppa.deb


• Debian libaffix2_2.1.1-2_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _i386.deb


• Debian libaffix2_2.1.1-2_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _ia64.deb


• Debian libaffix2_2.1.1-2_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _m68k.deb


• Debian libaffix2_2.1.1-2_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _mips.deb


• Debian libaffix2_2.1.1-2_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _mipsel.deb


• Debian libaffix2_2.1.1-2_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _powerpc.deb


• Debian libaffix2_2.1.1-2_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _s390.deb

Nokia Affix 2.1.1

• Debian affix_2.1.1-2_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_amd 64.deb


• Debian libaffix-dev_2.1.1-2_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_amd64.deb


• Debian libaffix2_2.1.1-2_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _amd64.deb

Nokia Affix 2.1.2

• Nokia affix_212_sec.patch
  http://affix.sourceforge.net/affix_212_sec.patch

Nokia Affix 3.2

• Nokia affix_320_sec.patch
  http://affix.sourceforge.net/affix_320_sec.patch

Nokia Affix BTFTP Client Filename Remote Buffer Overflow Vulnerability

References:

• Affix Homepage (Nokia)
  
• Nokia Affix Bluetooth btftp client buffer overflow (Kevin Finisterre)