Click to View

A few of Palm's Treo smartphones contain a security flaw that could allow anyone who gets physical access to an affected device obtain personal information, according to Symantec's SecurityFocus Web site.

The vulnerability, which affects the Palm OS Treo 650, 680 and 700p models, allows folks to use the "find" feature to bypass a user’s password and obtain information, even when the device is locked. Searches may be performed on text in Treo applications and databases (e.g. SMS Messages, Memos, Calendar, Tasks, etc).

Here's what Symantec has to say:

Palm OS Treo smartphones are vulnerable to a local information-disclosure vulnerability because the software fails to properly secure access to certain features when locked.

Successfully exploiting this issue allows attackers with physical access to affected devices to obtain potentially sensitive information. This may aid them in further attacks.

Palm representatives have informed PDAStreet the company will provide a carrier-approved software update to address this issue. They did not give a timeline as to when it would be available, however. But when it is, future Treos are scheduled to include the fix.