Microsoft Windows Mobile Overly Long vCard Name Field Denial of Service Vulnerability

Bugtraq ID:	44287
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Oct 21 2010 12:00AM
Updated:	Oct 21 2010 12:00AM
Credit:	Celil �?nüver from SecurityArchitect.Org
Vulnerable:	Microsoft Windows Mobile 6.5 Microsoft Windows Mobile 6.1 HTC TOUCH PRO 2 HTC TOUCH PRO 0
Not Vulnerable:

Microsoft Windows Mobile Overly Long vCard Name Field Denial of Service Vulnerability

Microsoft Windows Mobile is prone to a denial-of-service vulnerability because it fails to adequately validate user-supplied input.

An attacker can exploit this issue to crash a device running Windows Mobile, denying service to legitimate users. Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed.

Windows Mobile versions 6.1 and 6.5 are vulnerable; other versions may also be affected.

Microsoft Windows Mobile Overly Long vCard Name Field Denial of Service Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/44287.vcf

Microsoft Windows Mobile Overly Long vCard Name Field Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Windows Mobile Overly Long vCard Name Field Denial of Service Vulnerability

References:

• Alert! First Double Free Vulnerability in Windows Mobile (SecurityArchitect)
  
• Windows Mobile Homepage (Microsoft)