Palm WebOS Contacts Application HTML Injection Vulnerability
BID:45172
Info
Palm WebOS Contacts Application HTML Injection Vulnerability
| Bugtraq ID: | 45172 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 03 2010 12:00AM |
| Updated: | Dec 03 2010 12:00AM |
| Credit: | Orlando Barrera II |
| Vulnerable: |
Palm webOS 1.4.5 Palm webOS 1.4.4 Palm webOS 1.4.1 Palm webOS 1.4 |
| Not Vulnerable: |
Palm webOS 2.0 beta |
Discussion
Palm WebOS Contacts Application HTML Injection Vulnerability
Palm WebOS is prone to HTML-injection vulnerability that affects the Contacts application.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected application. This may allow an attacker to perform phishing attacks, gain access to sensitive information such as emails, email addresses, and contact list, or install a JavaScript backdoor such as a keylogger. Other attacks are also possible.
Palm WebOS versions prior to 2.0 beta are vulnerable.
Palm WebOS is prone to HTML-injection vulnerability that affects the Contacts application.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected application. This may allow an attacker to perform phishing attacks, gain access to sensitive information such as emails, email addresses, and contact list, or install a JavaScript backdoor such as a keylogger. Other attacks are also possible.
Palm WebOS versions prior to 2.0 beta are vulnerable.
Exploit / POC
Palm WebOS Contacts Application HTML Injection Vulnerability
An exploit is available. Please see the references for more information.
An exploit is available. Please see the references for more information.
Solution / Fix
Palm WebOS Contacts Application HTML Injection Vulnerability
Solution:
Reportedly the vendor has fixed the issue, however Symantec has not confirmed it. Please see the references for details.
Solution:
Reportedly the vendor has fixed the issue, however Symantec has not confirmed it. Please see the references for details.
References
Palm WebOS Contacts Application HTML Injection Vulnerability
References:
References:
- Palm WebOS Homepage (Palm)
- PalmPreExploit.docx (Cybermediaplanet)
- Researchers Uncover Holes In WebOS Smartphones (Darkreading)
- webOS 1.4.x Security Research (Cybermediaplanet)