Palm Pre WebOS version <= 1.1 Floating Point Crash

I. Description

The Palm Pre WebOS version <=1.1 suffers from a floating point exception crash when attempting to view a specially crafted web page. This vulnerability has been addressed in the latest patch from Palm and all users are recommended to update to WebOS version 1.2+.

II. Impact

If a user is sent to a malicious web page that contains specially crafted data, the LunaSysMgr process will crash, causing the phone to simulate a reboot. The crash itself is a floating point error that crashes the "LunaSysMgr" process and forces the phone to restart the process, simulating a reboot of the system. At the time of the discovery, the greatest risk to the system was a crash/denial of service vulnerability.

The crash does not occur when viewing the malicious web page while in landscape mode.


III Proof of Concept

The Palm Pre WebOS will crash upon opening a web page that contains 50,280 bytes of data and then attempts to refresh the page. Upon viewing the malicious web page the phone will "crash".

The following code will trigger the crash

"<meta http-equiv="refresh" content="1">AAAAA..." using 50280 or more characters after the refresh.

IV. About

This vulnerability was discovered by Townsend Ladd Harris

Vulnerability details will be posted to: http://tlhsecurity.blogspot.com/ upon release of a patch.

Mailing Lists post the vulnerabilities!

After a few days, both security focus and secunia published the vulnerabilities.

Links:

Bugtraq: Here
Secunia: Here

I have not submitted the floating point crash in the Web Browser to them yet, but apparently Secunia folks have read my blog and know an "unspecified" issues exists, so they made a placeholder.

Oddly, both Secunia and Securityfocus are both showing vulnerabilities in WebOS <=1.2.1 with unspecified details disclosed by the vendor, overall they claim something is wrong with it but give zero details. Why are these not merged with my issues or vice versa :/

Floating point details to come in next few days.

Thanks

-Ladd

Palm Pre WebOS <=1.1 Remote File Access Vulnerability

Below are the details of the remote file access vulnerability I have released to various vulnerability mailing lists. To view a flash video that demonstrates how to exploit this bug please check out: Click To Watch

The folks over at Precentral.net did a nice write up on the issue as well:

http://www.precentral.net/update-12-fixed-serious-file-security-issue

I. Description

The Palm Pre WebOS <=1.1 suffers from a JavaScript injection attack that allows a malicious attacker to access any file on the mobile device.

Palm has patched this vulnerability and all users are recommended to upgrade to WebOS version 1.2+.

Palm WebOS 1.2 patch notes can be found here:
http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article/50607_en.html#12

II. Impact

A specially crafted email can access any file on the Palm Pre WebOS version <=1.1 mobile device and send it to a web site of the attacker's choice just by viewing the email.

III. Details

The Palm Pre WebOS 1.1 and lower will parse and execute JavaScript contained in an email it receives. Exploiting this vulnerability allows an attacker to read/extract any file and post it to a remote website the attacker controls.

One particular file of interest is the "PalmDatabase.db3" file. Having this database file will give an attacker emails, email addresses, contact list information including names, phone numbers, etc. Limitations with binary data have been identified, however viewing binary data such as database files is still simple.

Proof of Concept

Creating an email with the following JavaScript in it will automatically upload a file of the attacker's choice to a remote web server:



To view a Flash demo of this exploit in action:

http://tlhsecurity.com/videos/FA.html

IV. About

This vulnerability was discovered by Townsend Ladd Harris

Special Thanks to :
- Chris Rohlf - Blog: http://em386.blogspot.com/
- Destinal #webos-internals (irc.freenode.com)
- Webos-Internals group #webos-internals(irc.freenode.com) Website: Here
- Bryce Kerley
- Dan Czarnecki
- Jeremy Rasmussen

Palm Pre WebOS <=1.1 Remote File Access Vulnerability Video

Once everyone is patched I will release the details on two vulnerabilities in the Palm Pre WebOS <=1.1

For now enjoy this FLASH Movie I made of the vulnerability
Click Here to Watch!

I did make the video myself and adobe was not used =p


Enjoy

-Ladd

WebOS 1.2 and Palm Patches my stuff

Palm has patched my latest critical vulnerability (as well as others) in the Palm Pre WebOS that allows for remote file access and exfiltration. I will publish details on this once everyone is at an adequate patch level.

WebOS 1.2 Patch notes : Here

See ya in a bit and I will have a video for everyone.

-Ladd

Presented at Sandia Malware Conference!!

Just got done presenting some mobile security research I have been performing as of late and it seems to have went well. I got a chance to meet some great industry/government folks in the area of malware analysis and reverse engineering.

Have not had much to post on the Pre since Palm has yet to release 1.2 (taking forever). As soon as they publish a version I will get back at, was on vacation and work took me away for a few weeks.

Promise some new bug info when 1.2 is released as I am ready for my disclosures and the video I have =p


-Ladd

No update for WebOS yet.

I really thought today would be the new update for Palm's WebOS, does not seem so. It is still early, however since Canada's Bell Pre is running WebOS version 1.1, I am skeptical of a new update today (though we did get an update the day the phone was released on Sprint).

As a side note, I had a chance to meet a gentlemen named Chris Clark (from http://www.isecpartners.com/) who is also doing some Palm Pre research. Very nice guy with some very interesting knowledge of the phone already. Hoping at some point we can team up on some work in the area. Thanks for the conversation Chris!

Ever vigilant for a new release...


-Ladd