BlackBerry Products PDF Distiller Remote Code Execution Vulnerability
Last Update Date:
28 Jan 2011
Release Date:
16 Dec 2010
5038
Views
RISK: Medium Risk
A vulnerability has been identified in BlackBerry Enterprise Server and BlackBerry Professional Software, which could be exploited by remote attackers to execute arbitrary code. This issue is caused by a buffer overflow error in the PDF distiller of the BlackBerry Attachment Service component when processing malformed PDF files, which could be exploited by attackers to crash an affected service or execute arbitrary code by convincing a user to open a specially crafted PDF file on a BlackBerry smartphone that is associated with a user account on a vulnerable BlackBerry Enterprise Server.
Impact
- Remote Code Execution
System / Technologies affected
- BlackBerry Enterprise Server Express version 5.0.1 for MS Exchange
- BlackBerry Enterprise Server Express version 5.0.2 for MS Exchange
- BlackBerry Enterprise Server Express version 5.0.2 for Lotus Domino
- BlackBerry Enterprise Server versions 4.1.3 through 5.0.2 for MS Exchange
- BlackBerry Enterprise Server versions 4.1.3 through 5.0.2 for Lotus Domino
- BlackBerry Enterprise Server versions 4.1.3 through 5.0.1 for GroupWise
- BlackBerry Professional Software version 4.1.4 for MS Exchange
- BlackBerry Professional Software version 4.1.4 for Lotus Domino
Solutions
- BlackBerry Enterprise Server Express version 5.0.2 for MS Exchange - Apply Interim Security Update 2:
http://www.blackberry.com/go/serverdownloads - BlackBerry Enterprise Server Express version 5.0.1 for MS Exchange - Apply Interim Security Update 1:
http://www.blackberry.com/go/serverdownloads - BlackBerry Enterprise Server Express version 5.0.2 for Lotus Domino - Apply Interim Security Update 1:
http://www.blackberry.com/go/serverdownloads - BlackBerry Enterprise Server version 5.0.0 for MS Exchange and Lotus Domino - Apply Interim Security Update 5:
http://www.blackberry.com/go/serverdownloads - BlackBerry Enterprise Server version 5.0.1 for MS Exchange, Lotus Domino, and GroupWise - Apply Interim Security Update 2:
http://www.blackberry.com/go/serverdownloads - BlackBerry Enterprise Server version 5.0.2 for MS Exchange and Lotus Domino - Apply Interim Security Update 2:
http://www.blackberry.com/go/serverdownloads - BlackBerry Enterprise Server version 4.1.7 for MS Exchange and Lotus Domin - Apply Interim Security Update 3:
http://www.blackberry.com/go/serverdownloads - BlackBerry Enterprise Server version 4.1.7 for GroupWise - Apply Interim Security Update 2:
http://www.blackberry.com/go/serverdownloads - BlackBerry Enterprise Server version 4.1.6 for MS Exchange, Lotus Domino, and GroupWise - Apply Interim Security Update 6:
http://www.blackberry.com/go/serverdownloads
Vulnerability Identifier
- No CVE information is available
Source
Share with