|
Motorola Cellular Phones Security Dialog Spoofing Vulnerability
|
|
Secunia Advisory:
|
SA19319
|
|
|
Release Date:
|
2006-03-22
|
|
Last Update:
|
2006-03-27
|
|
Popularity:
|
7,628 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Security Bypass
Spoofing
Exposure of sensitive information
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Motorola PEBL U6
Motorola V600
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-1366
CVE-2006-1367
CVE-2006-1365
|
|
Description:
Kevin Finisterre has reported a vulnerability in Motorola PEBL U6 and Motorola V600, which can be exploited by malicious people to trick users into accepting certain security dialogs.
The vulnerability is caused due to an input validation error where the remote Bluetooth device name isn't properly sanitised before being used in a security dialog. This can be exploited to trick users into accepting an incoming wireless Bluetooth connection to the "Headset Audio Gateway" on channel 3 by including newline characters in the device name.
Successful exploitation allows access to personal information stored in the cellular phone (e.g. phone book entries and SMS messages).
It has also been reported that it is possible to crash the handset by sending an overly long OBEX "setpath()" via the OBEX File Transfer service if the attacker's device has been paired. This may reportedly be exploited to execute arbitrary code, but has not been proven.
Solution:
The vulnerability has reportedly been fixed by the vendor.
Provided and/or discovered by:
Kevin Finisterre
Changelog:
2006-03-27: Added CVE references.
2006-03-27: Added CVE reference.
Original Advisory:
http://www.digitalmunition.com/DMA[2006-0321a].txt
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
