Nokia N70 and N73 Malformed OBEX Name Header Remote Denial of Service Vulnerability

Bugtraq ID:	32796
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 12 2008 12:00AM
Updated:	Dec 15 2008 07:41PM
Credit:	NCNIPC (China)
Vulnerable:	Nokia N73 0 Nokia N70 0
Not Vulnerable:

Nokia N70 and N73 Malformed OBEX Name Header Remote Denial of Service Vulnerability

Multiple Nokia phones are prone to a remote denial-of-service vulnerability in their handling of the Object Exchange protocol.

Attackers may exploit this issue to crash a vulnerable phone, creating a denial-of-service condition. Note that attackers must be able to communicate with the device via Bluetooth to take advantage of this issue.

This issue is reported in N70 and N73 phones; additional devices may also be vulnerable.

Nokia N70 and N73 Malformed OBEX Name Header Remote Denial of Service Vulnerability

The following example exploit is available:

• /data/vulnerabilities/exploits/32796.py

Nokia N70 and N73 Malformed OBEX Name Header Remote Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Nokia N70 and N73 Malformed OBEX Name Header Remote Denial of Service Vulnerability

References:

• Nokia Homepage (Nokia)
  
• Nokia N70/N73 Bluetooth Stack OBEX Implementation Denial of Service ([email protected])