[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Palm Pre WebOS <=1.1 Remote File Access Vulnerability
Palm has patched this vulnerability and all users are recommended to upgrade to WebOS version 1.2+.
Palm WebOS 1.2 patch information can be found here: http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#12
A specially crafted email can access any file on the Palm Pre WebOS version <=1.1 mobile device and send it to a web site of the attacker's choice just by viewing the email.
One particular file of interest is the "PalmDatabase.db3" file. Having this database file will give an attacker emails, email addresses, contact list information including names, phone numbers, etc. Limitations with binary data have been identified, however viewing binary data such as database files is still simple.
Proof of Concept
(Link provided instead of JS code )
To view a Flash demo of this exploit in action:
This vulnerability was discovered by Townsend Ladd Harris <PalmPreHacker[at]gmail.com>
Vulnerability details will be maintained at http://tlhsecurity.blogspot.com/2009/10/palm-pre-webos-11-remote-file-access.html
Special Thanks to :
- Chris Rohlf - Blog: http://em386.blogspot.com/
- Destinal #webos-internals (irc.freenode.com)
- Webos-Internals group #webos-internals (irc.freenode.com) http://www.webos-internals.org
- Bryce Kerley
- Dan Czarnecki
- Jeremy Rasmussen