Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
Siemens 45 Series Mobile Phones Can Be Crashed By Remote Users
|
|
SecurityTracker Alert ID: 1006713 |
|
SecurityTracker URL: http://securitytracker.com/id/1006713
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: May 7 2003
|
Impact:
Denial of service via network
|
Exploit Included: Yes
|
Version(s): Series 45
|
Description:
A buffer overflow vulnerability was reported in the Siemens 45-series mobile phones. A remote user can send a specially crafted SMS message to cause the
DWC Gr0up reported that a remote user can send a percentage character followed by 157 characters in place of an image name (%IMG_NAME) within an SMS message to cause the target recipient's phone to disconnect. Furthermore, the target user will be unable to view their SMS message inbox.
Some demonstration exploit strings are provided in the Source Message.
|
Impact:
A remote user can cause a target user's phone to disconnect and stop working properly.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.my-siemens.com/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
Date: 6 May 2003 07:28:10 -0000
Subject: Siemens Mobile Phone - Buffer Overflow
|
======================================
---> Product: Siemens Mobile Phone
---> Version: All *45 series phones
---> OffSite: www.siemens-mobile.com
---> Problem: Buffer Overflow.
======================================
** General Description **
In phones Siemens of a series 45, I found one more vulnerability, and
this time she(it) in my opinion is more dangerous.
At reception given sms, the phone is instantly disconnected with any not
clear sound when you include the phone.
With a kind it(he) works normally, but now to go in Messages-> Inbox to
you it will be not possible. All this occurs from for overflow
The buffer in the phone.
As is known for an insert in the message of a graphic picture such design
is used: "%IMG_NAME", and so if instead of IMG_NAME to insert any 157
symbols at reception by the subscriber of such message, there will be
above described actions.
** Exploit **
" %..........
............
............
............
............
............
............
............
............
............
............
............
............
... "
or
" % [157 symbols of any dust "
** Note **
- > you can not send the given message from the phone siemens as soon as
will try to transfer the message the phone to be switched off.
- > Is the fastest, the given vulnerability works and on other phones
siemens to check up there was no opportunity, all was checked on phones
of 45 series.
** Solution **
The decision remains only one to wait while developers will issue the new
version of an insertion and then only to begin to rock her(it) in the
phone.
** Contacts **
r2subj3ct@dwclan.org
subj@passwd.cc
www,dwcgr0up.com | www.dwcgr0up.com/subj/
irc.irochka.net *dwc *phreack *global *dhg
** Greeting **
J0k3r, D4rkGr3y, DethSpirit, r4ShRaY, Kabuto, fnq, agenox, L0vCh1Y,
DiZHarM, cybeast, Foster, Moby, ORB, MORPFEY, drG4njubas
3APA3A, DHG, Gipshack, BlackTigerz, rsteam, p0is0n, Security.nno.ru
HNCrew. And all who i know...
|
|
Go to the Top of This SecurityTracker Archive Page
|