Palm WebOS Email Notification System 'FROM' Field Arbitrary Script Code Injection Vulnerability

Bugtraq ID:	35932
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 04 2009 12:00AM
Updated:	Aug 21 2009 03:55PM
Credit:	Townsend Ladd Harris
Vulnerable:	Palm webOS 1.0.4 Palm webOS 1.0.3
Not Vulnerable:	Palm webOS 1.1

Palm WebOS Email Notification System 'FROM' Field Arbitrary Script Code Injection Vulnerability

Palm WebOS is prone to a vulnerability in the Email Notification System that lets attackers inject arbitrary script code. The issue occurs because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

The attacker's malicious script code would run in the context of the webserver process. This may facilitate a compromise of the application and the underlying device; other attacks are also possible.

Palm WebOS 1.0.4 is vulnerable; prior versions may also be affected.

Palm WebOS Email Notification System 'FROM' Field Arbitrary Script Code Injection Vulnerability

Attackers can exploit this issue via a browser.

Palm WebOS Email Notification System 'FROM' Field Arbitrary Script Code Injection Vulnerability

Solution:
The vendor has released an update. Please see the references for details.

Palm WebOS Email Notification System 'FROM' Field Arbitrary Script Code Injection Vulnerability

References:

• Palm WebOS Homepage (Palm)
  
• Palm Pre WebOS 1.0.4 Remote execution of arbitrary HTML code vulnerability ([email protected])
  
• webOS 1.1.0 Knowledge Base Article (Palm)