0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Palm Pre WebOS <=1.1 Remote File Access Vulnerability
[===================================================== Palm Pre WebOS <=1.1 Remote File Access Vulnerability ===================================================== # Title: Palm Pre WebOS <=1.1 Remote File Access Vulnerability # CVE-ID: () # OSVDB-ID: () # Author: Townsend Ladd Harris # Published: 2009-10-05 # Verified: yes view source print? I. Description The Palm Pre WebOS <=1.1 suffers from a JavaScript injection attack that allows a malicious attacker to access any file on the mobile device. Palm has patched this vulnerability and all users are recommended to upgrade to WebOS version 1.2+. Palm WebOS 1.2 patch information can be found here: http://kb.palm.com/wps/portal/kb/na/pre/p100eww/sprint/solutions/article /50607_en.html#12 II. Impact A specially crafted email can access any file on the Palm Pre WebOS version <=1.1 mobile device and send it to a web site of the attacker's choice just by viewing the email. III. Details The Palm Pre WebOS 1.1 and lower will parse and execute JavaScript contained in an email it receives. Exploiting this vulnerability allows an attacker to read/extract any file and post it to a remote website the attacker controls. One particular file of interest is the "PalmDatabase.db3" file. Having this database file will give an attacker emails, email addresses, contact list information including names, phone numbers, etc. Limitations with binary data have been identified, however viewing binary data such as database files is still simple. Proof of Concept Creating an email with the following JavaScript in it will automatically upload a file of the attacker's choice to a remote web server: (Link provided instead of JS code ) http://tlhsecurity.com/advisories/FA_Code.jpg To view a Flash demo of this exploit in action: http://tlhsecurity.com/videos/FA.html IV. About This vulnerability was discovered by Townsend Ladd Harris <PalmPreHacker[at]gmail.com> Vulnerability details will be maintained at http://tlhsecurity.blogspot.com/2009/10/palm-pre-webos-11-remote-file-ac cess.html # 0day.today [2024-12-25] #