WebOS 1.1 Vulnerability disclosure sent to Palm/ Off to Defcon!

I discovered what I believe to be a critical issue affecting WebOS 1.1 of the phone and submitted it to Palm. I have already received a response that it is being looked into, so hang on to your seats...

PS: I gave palm a POC that would involve connect back to my personal site and low and behold someone from Palm.com attempted to use my "toys" that would be accessible using the POC I gave them =p. Guess they are confirming it....

See you all at Defcon =p

-Ladd

Palm Sends me cool stuff and I have a potentially dangerous vulnerability

Palm sent me a touchstone and a shirt for the work I have been doing, it was nice of them. I have also found a new critical vulnerability, I will notify palm and I already have a nice proof of concept exploit for it =]. This new vuln affects WebOS 1.1.

FYI they have received my previous my DoS disclosure for 1.1 and was told it looked "legit" but no final confirmation yet.

Sorry for not posting lately, work plus family, plus research has kept me busy. Defcon, here I come!!!

-Ladd

Got my sendmail server up and New BUG!

Finally got my sendmail server up, started fuzzing the email client and found some very interesting things we can do with the Palm Pre. My friend Destinal (@ from #webos-internals crew on IRC freenode) is working with me to come up with some nifty attack vectors so we could have some cool stuff. Maybe in time for Defcon =p

Thanks to Jeremy Rasmussen for validating one of the attacks and letting me beat up his pre for a little...

-Ladd

Palm Updates 1.1/1.04 Release Notes and New vuln sent to Palm

Palm emailed me today to let me know that they have updated the release notes for 1.0.4 to include vulnerability details. They also updated the 1.1 notes to give credit to me for my discoveries =p

Link is here: Here

I also sent in a new advisory to Palm that is a bug that will crash the phone that affects version 1.1 of WebOS :)

You may see vulnerability details on the issues found in 1.0.4 before Defcon o.0

-Ladd

Bugtraq and Secunia Finally Posted

Bugtraq finally posted my 1.0.3 issues and Secunia has contact Palm to obtain more information, so great. I am currently writing up a new DoS for the Palm 1.1 WebOS that is nifty/simple and will be submitting it to them today.

After speaking with Palm they intend to update all the notes to provide details on each vulnerability that I found in 1.0.3 and 1.0.4 soon.

Secunia Link: Here
BugTraq Link: Here (of course they didnt provide many details here)

-Ladd

Update 1.1 and my critical vulnerability isnt mentioned

I came back from dinner and found that WebOS 1.1 came out and behold, the potentially critical vulnerability I found may not have been fixed and not mentioned in the release notes nor was any credit given as to who found it. I am sadly disappointed and hope my new vuln works on the 1.1 WebOS release.

Instead of fixing the critical issues they may have removed the notifications that allowed it to be exploited.

PS: New crash works on 1.1 and not sure how I am going to release it.

-Ladd

Palm Pre WebOs 1.0.3+ Memory Corruption Via Long Attacker Controlled URI

So the Palm Pre WebOS 1.0.3 suffers from an overly long URL Memory corruption vulnerability that causes the phone to "crash" (Denial of Service) that has the potential for arbitrary code execution. Original Patch notes for vulnerability:
Here

Clicking on a malicious URL that has a character length greater than or equal to 4063 characters causes the phone (the LunaSysMgr process) to "crash". This crash looks like a reboot however it is merely the LunaSysMgr service stopping and starting (via segfault). I did not research whether code execution was possible due to time constraints.

The attack vectors of this vulnerability/Crash can be via Email, AIM, SMS, or any application that when a user clicks the link will load the malicious URL.

1. Proof of concept

Create a Web link of say http://www.google.com/ . "A" x 4040 (total length needs to be equal to or greater than 4063 characters).

If you trust me go here: http://tinyurl.com/mbmnbh

Upon clicking this malicious link, LunaSysMgr will segfault and generate a "mini" corefile on the system. The minicore file from the crash is shown below:

"Cmd: LunaSysMgr
Pid: 1190
CrashedThread: 1545
Signal: 11
minicore2:
Process /usr/bin/LunaSysMgr (1190) received SIGSEGV(11).
Spawning gdb...
[Thread debugging using libthread_db enabled]
0x40dbf7a4 in strlen () from /lib/libc.so.6

========== STACKTRACE OUTPUT ==========

Dumping thread:
#0 0x40dbf7a4 in strlen () from /lib/libc.so.6
#1 0x48f7fffc in BrowserAdapter::msgTitleAndUrlChanged ()
from /usr/lib/BrowserPlugins/BrowserAdapter.so
#2 0x48f7db28 in BrowserClientBase::handleAsyncMessage ()"

As you can see, we made LunaSysMgr segfault and the phone "reboots" =p

The current version of 1.0.4 of WebOS suffers from the same type of crash using different URL sizes. Palm is aware and when I reported them I was told they are known issues, but stated I was not the one who identified first. Until they publish who did, I will not post any details (though I do have PoC's for two new crashes in 1.0.4), just wanted to say "yeah I already know about the new ones".

More Bugs to follow, just waiting on Palm and their patches =]

Thanks: Wife and daughter =p, Daniel Czarnecki, Chris Rohlf, Jeremy Rasmussen

-Ladd