Vulnerability

    HotSync

Affected

    Handspring Visor Network HotSync

Description

    Jay  C.  Austad  found  following.   If  you  have Network HotSync
    (provided on the  CD that comes  with your Visor)  enabled on your
    machine, and a  malicious user knows  your name (ex.  John Smith),
    and   the   ip   of   your   machine   (ex.   192.168.22.22,    or
    jsmith.company.com),  he  can  change  the  name  on hi s Visor to
    yours, do  a Network  hotsync with  your ip,  and download  all of
    your email, send email as  you, and perform any function  that you
    can.

    There is no password or authentication of any kind.  If you wanted
    to read your co-workers email,  or send a nasty message  from them
    to their boss, all you would need to do is put his name into  your
    visor (Jim Beam), and do a network sync to jbeam.company.com.

    Guess is that this  is true for the  Palm too, since the  software
    is effectively  the same.   The only  difference seen  is the  USB
    driver support and the fact that it creates its icons in a  folder
    called "Handspring  Desktop".   Everything else  (executable icon,
    splash screen, etc.) says Palm Computing or 3Com.

Solution

    Nothing yet.