A persistent denial-of-service vulnerability exists in devices running Symbian OS 7.0 UIQ 2.0 and UIQ 2.1.
The vulnerability is triggered by corruption of the system file:
C:\System\Data\colorscm.dat
When this file is replaced with an empty or malformed file, the device becomes unstable and eventually enters an unrecoverable boot state, effectively bricking the device.
- Sony Ericsson P800
- Sony Ericsson P900
- Sony Ericsson P910
- Motorola A920
- Motorola A925
- Motorola A1000
- Motorola M1000
- BenQ P30
- BenQ P31
- Arima U300
- Arima U308
- Nokia 6708
- Symbian OS 7.0 UIQ 2.0
- Symbian OS 7.0 UIQ 2.1
colorscm.dat file is a critical system configuration file responsible for storing UI color scheme data.
If this file is replaced with:
- an empty file or
- invalid or malformed content the following behavior occurs:
- UI color scheme becomes corrupted
- Newly launched applications fail to start (only applications already resident in RAM remain functional)
- After rebooting the device, the operating system fails during the boot process and becomes permanently stuck on the startup screen.
- Persistent Denial of Service (DoS)
- Permanent device brick
- No software-based recovery for end users
- User data becomes inaccessible
- The issue persists across reboots.
Affected UIQ 2.x devices do not support hardware key combinations for performing a hard reset while powered off. Once the device enters the bricked state, recovery requires one of the following:
- Reflashing firmware using a service box
- Cleaning or restoring the C: drive using professional service tools End users cannot recover the device without specialized hardware.
- Local filesystem access
- Any application or process capable of writing to the system directory:
C:\System\Data\ - No further user interaction is required beyond rebooting the device.
There is no official patch available due to the legacy status of the platform. Possible mitigations include:
- Avoiding untrusted softwares
- Preventing modification of
colorscm.dat
Ali BEYAZ (symbuzzer) - https://github.com/symbuzzer
This documentation is provided for educational, research and defensive purposes only. The author is not responsible for any damage caused by misuse of this information.