HTC OBEX FTP Service in Android Directory Traversal Vulnerability

Bugtraq ID:	48821
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 20 2011 12:00AM
Updated:	Jul 20 2011 12:00AM
Credit:	Alberto Moreno Tablado
Vulnerable:	HTC Wildfire 0 HTC Desire HD 0 HTC Aria 0
Not Vulnerable:

HTC OBEX FTP Service in Android Directory Traversal Vulnerability

HTC devices running the Bluetooth OBEX FTP service on Android OS is prone to a directory-traversal vulnerability.

Exploiting this issue allows an attacker to read or download arbitrary files from locations outside the application's current directory and obtain sensitive information. Other attacks may also be possible.

HTC OBEX FTP Service in Android Directory Traversal Vulnerability

An attacker can exploit this issue by using an FTP client installed on a computer or device that has Bluetooth capabilities.

HTC OBEX FTP Service in Android Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HTC OBEX FTP Service in Android Directory Traversal Vulnerability

References:

• HTC / Android OBEX FTP Service Directory Traversal Vulnerability (Alberto Moreno Tablado)
  
• Vendor Homepage (HTC)