Re: Multiple Security Vulnerabilities in Sharp Zaurus

From: Stephen Harris (bugtraqat_private)
Date: Wed Jul 10 2002 - 13:07:58 PDT

  • Next message: NGSSoftware Insight Security Research: "Microsoft SQL Server 2000 'BULK INSERT' Buffer Overflow (#NISR11072002)"

    On Wed, Jul 10, 2002 at 01:49:11PM -0400, SURUAZ wrote:
    > 
    > The Sharp(R) Zaurus(tm) SL-5000D and SL-5500 handhelds use FTP for
    > performing sync operations with a PC.  The FTP daemon on both Zaurus
    > models is built into QPE, the default windowing system for the units, on
    > port 4242.  The daemon binds to all network interfaces on the Zaurus,
    > including any wireless network or PPP interfaces.
    
    [ snip ]
    
    > Zaurus users who use ethernet or PPP to attach to a network should
    > either discontinue use of QPE or place themselves behind a firewal until
    > a patch for QPE is released.
    
    According to http://www.linuxjournal.com/article.php?sid=5902
      At least, the latest version of the ROM makes the FTP server open only on
      the USB network interface
    
    Document is dated Jul 2, 2002.
    
    My ROM is 2.12 (machine was bought on July 9!) and if I try to connect
    to port 4242 over wireless network the connection is terminated immediately.
    I haven't tried to connect via USB yet (not even unwrapped the USB adapter).
    
    -- 
    
    rgds
    Stephen
    



    This archive was generated by hypermail 2b30 : Wed Jul 10 2002 - 21:43:58 PDT