On late Friday the 29th of December, Collin Mulliner published
proof-of-concept exploits of MMS vulnerabilities that he discovered
six months ago. When Collin first discovered the vulnerabilities he
informed the software vendors, but as he has not received a report
within half-a-year, he decided to now publish the exploit at the
23rd Chaos Communication Congress in Berlin.
The proof-of-concept exploits target vulnerabilities in the SMIL
presentation control language in MMS messages. Region tags in MMS
SMIL are vulnerable to buffer overflow causing arbitrary code
execution. In other words, if those tags get too large in content
it makes it to possible for a malicious MMS message to execute code
on the target device.
It is still unknown which phones are vulnerable to this exploit.
Collin's research has confirmed a vulnerability in the IPAQ 6315
and i-mate PDA2k, but it is quite likely that all Pocket PC 2003
and Windows Smartphone 2003 devices are also vulnerable.
The good news is that the only devices for which the
proof-of-concept code is available are the IPAQ 6315 and i-mate
PDA2k. And even in those devices the attacker needs to guess the
correct memory slot where the MMS processing code is executing and
send correctly crafted exploit code. This means that a malicious
MMS message will most likely only be able to crash the device, not
to to exploit it.
So while Collin's discovery is very significant, it does not pose
immediate danger to any large group of users. And although it is
possible to create an MMS worm or other malware that uses the
vulnerability, this particular exploit cannot be directly used in
creating malware.
