Secunia

Kevin Finisterre has reported a vulnerability in Motorola PEBL U6 and Motorola V600, which can be exploited by malicious people to trick users into accepting certain security dialogs.

The vulnerability is caused due to an input validation error where the remote Bluetooth device name isn't properly sanitised before being used in a security dialog. This can be exploited to trick users into accepting an incoming wireless Bluetooth connection to the "Headset Audio Gateway" on channel 3 by including newline characters in the device name.

Successful exploitation allows access to personal information stored in the cellular phone (e.g. phone book entries and SMS messages).

It has also been reported that it is possible to crash the handset by sending an overly long OBEX "setpath()" via the OBEX File Transfer service if the attacker's device has been paired. This may reportedly be exploited to execute arbitrary code, but has not been proven.

Solution
The vulnerability has reportedly been fixed by the vendor.

Provided and/or discovered by
Kevin Finisterre

Changelog
Further details available in Customer Area

Original Advisory
http://www.digitalmunition.com/DMA[2006-0321a].txt

Deep Links
Links available in Customer Area