TITLE:
Toshiba Bluetooth Stack File Upload Directory Traversal Vulnerability

SECUNIA ADVISORY ID:
SA18437

VERIFY ADVISORY:
http://secunia.com/advisories/18437/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
>From local network

SOFTWARE:
Toshiba Bluetooth Stack 4.x
http://secunia.com/product/6807/
Toshiba Bluetooth Stack 3.x
http://secunia.com/product/6806/

DESCRIPTION:
Kevin Finisterre has reported a vulnerability in Toshiba Bluetooth
Stack, which can be exploited by malicious people to bypass certain
security restrictions.

The vulnerability is caused due to an input validation error in the
handling of file uploads via the "OBEX Push services". This can be
exploited to upload files to locations outside the user-specified
upload directory via directory traversal attacks through a wireless
Bluetooth connection.

Successful exploitation requires that the user accepts the file
upload request.

The vulnerability has been reported in version 4.00.23 and prior.

Note: Products from other vendors that use the Toshiba Bluetooth
Stack may also be affected.

SOLUTION:
Do not accept file upload request from non-trusted person.

PROVIDED AND/OR DISCOVERED BY:
Kevin Finisterre

ORIGINAL ADVISORY:
http://www.digitalmunition.com/DMA%5B2006-0112a%5D.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------