Secunia

Kevin Finisterre has reported two vulnerabilities in Affix, which can be exploited by malicious people to compromise a vulnerable system.

1) A boundary error in the processing of filenames in the btftp client utility can be exploited to cause a buffer overflow via an overly long filename (more than 101 bytes) by tricking a user into browsing a malicious OBEX file share through a wireless Bluetooth connection.

Successful exploitation allows execution of arbitrary code.

2) An input validation error in the handling of filenames in btobex.c can be exploited to inject arbitrary shell commands by e.g. uploading a file with a specially crafted filename on a vulnerable btsrv server through a wireless Bluetooth connection.

The vulnerabilities have been reported in versions 2.1.2 and 3.2.0. Prior versions may also be affected.

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Kevin Finisterre

Changelog
Further details available in Customer Area

Original Advisory
1) http://www.digitalmunition.com/DMA%5B2005-0712a%5D.txt
2) http://www.digitalmunition.com/DMA%5B2005-0712b%5D.txt

Deep Links
Links available in Customer Area