The Palm Hotsync manager is vulnerable to a buffer overflow attack that can crash the hotsync application and possibly be used to execute arbitrary code on the machine running the hotsync. Hotsync manager runs on tcp port 14238. Exploit and full advisory here.
248da307134983a853fc649115b333378def514fe8249763e567a75ad6d28e29
Hi.
In the spirit of w00giving, we did a little research on attacks that can be
performed on the Palm Pilot (we're also searching for tools that can turn
the Palm into an attacking tool, but that's another thing).
A hotsync DoS attack is not as sexy as breaking to networks via printers,
but it still deserves some attention ;-)
The Palm Hotsync manager is vulnerable to a buffer overflow attack that can
crash the hotsync application and possibly be used to execute arbitrary code
on the machine running the hotsync.
Vulnerable systems:
HotSync Manager 3.0.4 under Windows 98
Non Vulnerable systems:
HotSync Manager under Windows 2000
Details
--------
When the Hotsync manager is set to 'network' mode, it listens on port 14238.
By sending a large amount of data to that port followed by a newline, it's
possible to crash the HotSync application.
3Com has been notified of this, and promised that the next release of the
Hotsync manager will be fixed.
Our full advisory can be found at:
http://www.securiteam.com/exploits/
Palm_HotSync_Manager_is_vulnerable_to_Denial_of_Service_attack.html
(NOTE: URL wrapped)
-------------------------
Aviram Jenik
SecuriTeam
http://www.SecuriTeam.com