PalmOS ICMP Flood Remote Denial Of Service Vulnerability

Bugtraq ID:	7597
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	May 14 2003 12:00AM
Updated:	May 14 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Shaun Colley <[email protected]>.
Vulnerable:	Palm Palm OS 4.1 Palm Palm OS 4.0 Palm Palm OS 3.5.2 Palm Palm OS 3.5 h Palm Palm OS 3.3
Not Vulnerable:

PalmOS ICMP Flood Remote Denial Of Service Vulnerability

A problem with PalmOS may result in a denial of service.

It has been reported that PalmOS becomes unstable when flooded with ICMP ECHO_REQUEST traffic. A remote attacker can trigger a device lockup condition or cause the Palm OS device to loose network connectivity.

This could allow a remote attacker to deny service to legitimate users of a PalmOS device that is connected to a network.

PalmOS ICMP Flood Remote Denial Of Service Vulnerability

The following proof of concept exploit has been supplied:

• /data/vulnerabilities/exploits/PalmDoS.c

PalmOS ICMP Flood Remote Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PalmOS ICMP Flood Remote Denial Of Service Vulnerability

References:

• Palm WebOS Homepage (Palm)
  
• PalmOS ICMP flood DoS. (Shaun Moore )
  
• RE: PalmOS ICMP flood DoS. ("Jay D. Thomson" )