NVD

Id
5565  
Name
CVE-2008-5825  
Description
The SmartPoster implementation on the Nokia 6131 Near Field Communication (NFC) phone with 05.12 firmware does not properly display the URI record when the Title record contains a certain combination of space, CR (aka ), and . (dot) characters, which allows remote attackers to trick a user into loading an arbitrary URI via a crafted NDEF tag, as demonstrated by (1) an http: URI for a malicious web site, (2) a tel: URI for a premium-rate telephone number, and (3) an sms: URI that triggers purchase of a ringtone.  
Reject
 
CVSS Version
2  
CVSS Score
2.6  
Severity
Low  
CVSS Base Score
2.6  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-03  
Published
2009-01-02  
Modified Date
2009-03-18  
Seq
2008-5825  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
34609 5565 CVE-2008-5825 20080816 Nokia 6131 NFC URI/URL Spoofing and DoS Advisory  View
34610 5565 CVE-2008-5825 20080816 Nokia 6131 NFC URI/URL Spoofing and DoS Advisory  View
34611 5565 CVE-2008-5825 http://events.ccc.de/congress/2008/Fahrplan/attachments/1109_collin_mulliner_eusecwest08_attacking_nfc_phones_slim.pdf  View
34612 5565 CVE-2008-5825 http://events.ccc.de/congress/2008/Fahrplan/events/2639.en.html  View
34613 5565 CVE-2008-5825 http://www.mulliner.org/nfc/feed/collin_mulliner_25c3_attacking_nfc_phones.pdf  View
34614 5565 CVE-2008-5825 http://www.mulliner.org/nfc/feed/collin_mulliner_eusecwest08_attacking_nfc_phones.pdf  View
34615 5565 CVE-2008-5825 http://www.mulliner.org/security/advisories/nokia6131nfc_uri_spoofing_and_dos_advisory.txt  View
34616 5565 CVE-2008-5825 30716  View
34617 5565 CVE-2008-5825 nokia-6131-ndef-uri-spoofing(44527)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
43038 JVNDB-2009-004045 NFC 電話上で稼動する SmartPoster 実装におけるユーザを騙して任意の URI 読み込ませる脆弱性 Nokia 6131 Near Field Communication (NFC) 電話上で稼動する SmartPoster 実装は、Title レコードが、スペース、CR、および . (ドット) 文字の特定の組み合わせを含んでいる際、URI レコードを適切に表示しないため、ユーザを騙して任意の URI 読み込ませる脆弱性が存在します。 CVE-2008-5825 35938 CVE-2008-5825 5565 2.6 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-004045.html 2009-01-02 2012-09-25 View