[NEWS] Bluetooth SIG DoS

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Bluetooth SIG DoS
------------------------------------------------------------------------

SUMMARY

Due to the nature of "ping" in the Bluetooth protocol, where a connection
must be established, and the limited amount of connections that (standard)
Bluetooth stacks can manage, a simple ping flood with l2ping, and cause
the device to stop responding as long as the attack continues.

DETAILS

Vulnerable Systems:
* Nokia 7650 (Symbian 6.0)
* Nokia 6600 (Symbian 7.0)
* Siemens V55
* Motorola S55
* Conceptronic (CBTU) Bluetooth dongle on Windows 2003

l2ping is a ping tool that was design to continue sending ping requests
even when the device does not responding. That means that when a device
does not responds it will continue sending packets, so rebooting the
system will not help avoiding the DoS attack. With some systems even
hidden mode is vulnerable for the attack (Nokia 7650 and 6600, Symbian 6
and Symbian 7).

ADDITIONAL INFORMATION

The information has been provided by <mailto:hugo@infohacking.com> hugo.
The original article can be found at:
<http://www.infohacking.com/INFOHACKING_RESEARCH/Our_Advisories/bt/index.html> http://www.infohacking.com/INFOHACKING_RESEARCH/Our_Advisories/bt/index.html

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.