Palm OS Weak Encryption Vulnerability
BID:1715
Info
Palm OS Weak Encryption Vulnerability
| Bugtraq ID: | 1715 |
| Class: | Design Error |
| CVE: |
CVE-2000-1008 |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 26 2000 12:00AM |
| Updated: | Jul 11 2009 03:56AM |
| Credit: | Discovered by @stake <[email protected]> and posted in an @stake security advisory <A092600-1> on Sep 26, 2000. |
| Vulnerable: |
Palm Palm OS 3.5.2 |
| Not Vulnerable: | |
Discussion
Palm OS Weak Encryption Vulnerability
Palm OS is shipped with a security feature which enables a user to set password protection on various applications.The HotSync process allows a user to connect to a machine on the network through their Palm device. This process involves the device to send the encoded password to the HotSync Manager or HotSync Network Server on the network. The purpose of this transmission is to verify the password protection is still enabled when applications are being accessed from the network.
The encoded password block is stored in the 'Unsaved Preferences' database on the Palm device. Due to a weak encryption scheme, it is possible to decrypt the password block into the actual ASCII format with the use of an exploit tool. Physical access to the device is required in order to exploit this vulnerability.
Successful exploitation yields unauthorized access to private data.
Palm OS is shipped with a security feature which enables a user to set password protection on various applications.The HotSync process allows a user to connect to a machine on the network through their Palm device. This process involves the device to send the encoded password to the HotSync Manager or HotSync Network Server on the network. The purpose of this transmission is to verify the password protection is still enabled when applications are being accessed from the network.
The encoded password block is stored in the 'Unsaved Preferences' database on the Palm device. Due to a weak encryption scheme, it is possible to decrypt the password block into the actual ASCII format with the use of an exploit tool. Physical access to the device is required in order to exploit this vulnerability.
Successful exploitation yields unauthorized access to private data.
Solution / Fix
Palm OS Weak Encryption Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].