Title: Palm OS Weak Encryption Vulnerability
Severity: MODERATE
Description:
Palm OS is shipped with a security feature which enables a user to set password protection on various applications.The HotSync process allows a user to connect to a machine on the network through their Palm device. This process involves the device to send the encoded password to the HotSync Manager or HotSync Network Server on the network. The purpose of this transmission is to verify the password protection is still enabled when applications are being accessed from the network.
The encoded password block is stored in the 'Unsaved Preferences' database on the Palm device. Due to a weak encryption scheme, it is possible to decrypt the password block into the actual ASCII format with the use of an exploit tool. Physical access to the device is required in order to exploit this vulnerability.
Successful exploitation yields unauthorized access to private data.
Affected Products:
- Palm Palm OS 3.5.2
References:
- Palm: Palm OS Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
