Nokia Affix BTSRV Device Name Remote Command Execution Vulnerability

Bugtraq ID:	14672
Class:	Input Validation Error
CVE:	CVE-2005-2716
Remote:	Yes
Local:	No
Published:	Aug 26 2005 12:00AM
Updated:	Jul 12 2009 05:06PM
Credit:	Discovery is credited to Kevin Finisterre.
Vulnerable:	Nokia Affix 3.2 Nokia Affix 3.1 Nokia Affix 3.0 Nokia Affix 2.1.2 Nokia Affix 2.1.1 - Debian Linux 3.1 sparc - Debian Linux 3.1 s/390 - Debian Linux 3.1 ppc - Debian Linux 3.1 mipsel - Debian Linux 3.1 mips - Debian Linux 3.1 m68k - Debian Linux 3.1 ia-64 - Debian Linux 3.1 ia-32 - Debian Linux 3.1 hppa - Debian Linux 3.1 arm - Debian Linux 3.1 amd64 - Debian Linux 3.1 alpha - Debian Linux 3.1 Nokia Affix 2.1 - Debian Linux 3.1 sparc - Debian Linux 3.1 s/390 - Debian Linux 3.1 ppc - Debian Linux 3.1 mipsel - Debian Linux 3.1 mips - Debian Linux 3.1 m68k - Debian Linux 3.1 ia-64 - Debian Linux 3.1 ia-32 - Debian Linux 3.1 hppa - Debian Linux 3.1 arm - Debian Linux 3.1 alpha - Debian Linux 3.1 Nokia Affix 2.0.2 Nokia Affix 2.0.1 Nokia Affix 2.0
Not Vulnerable:

Nokia Affix BTSRV Device Name Remote Command Execution Vulnerability

Nokia Affix BTSRV is affected by a remote command execution vulnerability.

An attacker can supply arbitrary commands through a device name and have them executed in the context of the service. This can lead to a complete compromise.

Nokia Affix BTSRV Device Name Remote Command Execution Vulnerability

An exploit is not required.

Nokia Affix BTSRV Device Name Remote Command Execution Vulnerability

Solution:
Debian has released advisory DSA 796-1 to address this issue. Please see the attached advisory for details on obtaining and applying fixes.

The vendor has released patches to address this issue.


Nokia Affix 2.1.1

• Debian affix_2.1.1-3_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_alp ha.deb


• Debian affix_2.1.1-3_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_amd 64.deb


• Debian affix_2.1.1-3_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_arm .deb


• Debian affix_2.1.1-3_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_hpp a.deb


• Debian affix_2.1.1-3_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_i38 6.deb


• Debian affix_2.1.1-3_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_ia6 4.deb


• Debian affix_2.1.1-3_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_m68 k.deb


• Debian affix_2.1.1-3_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_mip s.deb


• Debian affix_2.1.1-3_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_mip sel.deb


• Debian affix_2.1.1-3_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_pow erpc.deb


• Debian affix_2.1.1-3_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_s39 0.deb


• Debian affix_2.1.1-3_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-3_spa rc.deb


• Debian libaffix-dev_2.1.1-3_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-3_alpha.deb


• Debian libaffix-dev_2.1.1-3_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-3_amd64.deb


• Debian libaffix-dev_2.1.1-3_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-3_arm.deb


• Debian libaffix-dev_2.1.1-3_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-3_hppa.deb


• Debian libaffix-dev_2.1.1-3_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-3_i386.deb


• Debian libaffix-dev_2.1.1-3_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-3_ia64.deb


• Debian libaffix-dev_2.1.1-3_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-3_m68k.deb


• Debian libaffix-dev_2.1.1-3_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-3_mips.deb


• Debian libaffix-dev_2.1.1-3_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-3_mipsel.deb


• Debian libaffix-dev_2.1.1-3_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-3_powerpc.deb


• Debian libaffix-dev_2.1.1-3_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-3_s390.deb


• Debian libaffix-dev_2.1.1-3_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1. 1-3_sparc.deb


• Debian libaffix2_2.1.1-3_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3 _alpha.deb


• Debian libaffix2_2.1.1-3_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3 _amd64.deb


• Debian libaffix2_2.1.1-3_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3 _arm.deb


• Debian libaffix2_2.1.1-3_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3 _hppa.deb


• Debian libaffix2_2.1.1-3_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3 _i386.deb


• Debian libaffix2_2.1.1-3_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3 _ia64.deb


• Debian libaffix2_2.1.1-3_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3 _m68k.deb


• Debian libaffix2_2.1.1-3_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3 _mips.deb


• Debian libaffix2_2.1.1-3_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3 _mipsel.deb


• Debian libaffix2_2.1.1-3_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3 _powerpc.deb


• Debian libaffix2_2.1.1-3_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3 _s390.deb


• Debian libaffix2_2.1.1-3_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-3 _sparc.deb

Nokia Affix 2.1.2

• Nokia patch_btsrv_affix_2_1_2
  http://affix.sourceforge.net/patch_btsrv_affix_2_1_2

Nokia Affix 3.2

• Nokia patch_btsrv_affix_3_2_0
  http://affix.sourceforge.net/patch_btsrv_affix_3_2_0

Nokia Affix BTSRV Device Name Remote Command Execution Vulnerability

References:

• Affix Homepage (Nokia)
  
• DMA[2005-0826a] - 'Nokia Affix Bluetooth btsrv poor use of popen()' (Kevin Finisterre)