BlackBerry Enterprise Server Attachment Service PDF Distiller Vulnerability
20 Apr. 2010
Summary
Successful exploitation of this vulnerability requires a malicious individual to persuade a BlackBerry smartphone user to open a specially crafted PDF file on a BlackBerry smartphone that is associated with a user account on a BlackBerry Enterprise Server. The PDF file may be attached to an email message or the BlackBerry smartphone user may retrieve it from a web site using the BlackBerry Browser.
Vulnerable Systems:
*BlackBerry Enterprise Server Express version 5.0.1 and 5.0.2 for Microsoft Exchange
*BlackBerry Enterprise Server Express version 5.0.2 for IBM Lotus Domino
*BlackBerry Enterprise Server versions 4.1.3 through 5.0.2 for Microsoft Exchange and IBM Lotus Domino
*BlackBerry Enterprise Server versions 4.1.3 through 5.0.1 for Novell GroupWise
*BlackBerry Professional Software version 4.1.4 for Microsoft Exchange and IBM Lotus Domino
Immune Systems:
*BlackBerry Device Software
*BlackBerry Internet Service
*BlackBerry Desktop Manager
*BlackBerry Mobile Voice System
The vulnerability could allow a malicious individual to cause buffer overflow errors, which may result in arbitrary code execution on the computer that hosts the BlackBerry Attachment Service. While code execution is possible, an attack is more likely to result in the PDF rendering process terminating before it completes. In the event of such an unexpected process termination, the PDF rendering process will restart automatically but will not resume processing the same PDF file
Vendor Status:
Blackberry had issued an update for this vulnerability
