>
>
> TITLE:
> Motorola Cellular Phones Security Dialog Spoofing Vulnerability
>
> SECUNIA ADVISORY ID:
> SA19319
>
> VERIFY ADVISORY:
> http://secunia.com/advisories/19319/
>
> CRITICAL:
> Less critical
>
> IMPACT:
> Security Bypass, Spoofing, Exposure of sensitive information
>
> WHERE:
> From remote
>
> OPERATING SYSTEM:
> Motorola V600
> http://secunia.com/product/8840/
> Motorola PEBL U6
> http://secunia.com/product/8841/
>
> DESCRIPTION:
> Kevin Finisterre has reported a vulnerability in Motorola PEBL U6 and
> Motorola V600, which can be exploited by malicious people to trick
> users into accepting certain security dialogs.
>
> The vulnerability is caused due to an input validation error where
> the remote Bluetooth device name isn't properly sanitised before
> being used in a security dialog. This can be exploited to trick users
> into accepting an incoming wireless Bluetooth connection to the
> "Headset Audio Gateway" on channel 3 by including newline characters
> in the device name.
>
> Successful exploitation allows access to personal information stored
> in the cellular phone (e.g. phone book entries and SMS messages).
>
> It has also been reported that it is possible to crash the handset by
> sending an overly long OBEX "setpath()" via the OBEX File Transfer
> service if the attacker's device has been paired. This may reportedly
> be exploited to execute arbitrary code, but has not been proven.
>
> SOLUTION:
> The vulnerability has reportedly been fixed by the vendor.
>
> PROVIDED AND/OR DISCOVERED BY:
> Kevin Finisterre
>
> ORIGINAL ADVISORY:
> http://www.digitalmunition.com/DMA[2006-0321a].txt
>