TITLE:
AmbiCom Blue Neighbors Object Push Service Buffer Overflow

SECUNIA ADVISORY ID:
SA18466

VERIFY ADVISORY:
http://secunia.com/advisories/18466/

CRITICAL:
Less critical

IMPACT:
DoS, System access

WHERE:
>From remote

SOFTWARE:
AmbiCom Blue Neighbors 2.x
http://secunia.com/product/6834/

DESCRIPTION:
Kevin Finisterre has reported a vulnerability in AmbiCom Blue
Neighbors, which can be exploited by malicious people to cause a DoS
(Denial of Service) and potentially compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the filename
handling in the Object Push service in "Blue Neighbors.EXE". This can
be exploited to cause a buffer overflow by sending a file with an
overly long filename (more than 256 bytes) through a wireless
Bluetooth connection.

Successful exploitation may allow execution of arbitrary code, but
requires that the user accepts the file.

The vulnerability has been reported in version 2.50 build 2500. Other
versions may also be affected.

SOLUTION:
Do not accept file transfer requests from untrusted people.

PROVIDED AND/OR DISCOVERED BY:
Kevin Finisterre

ORIGINAL ADVISORY:
http://www.digitalmunition.com/DMA%5B2006-0115a%5D.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------