Results 1 to 7 of 7

RIM has released a vulnerability announcement detailing issues with the method of PDF distillation on ... Smartphone News forum

  1. #1
    cherrichiodo's Avatar
    cherrichiodo no está en línea PINStacked!
    Join Date
    Aug 2006
    PIN/ID
    ATA
    Posts
    17,164

    RIM PDF Attachment Vulnerability Announced

    Advertisement



    RIM has released a vulnerability announcement detailing issues with the method of PDF distillation on the company’s Blackberry Enterprise Server. Also announced via US-CERT. Unfortunately for customers of RIM, and users of the now nearly ubiquitous Blackberry Smartphone (users, that is, of Blackberry’s in the Enterprise, not necessarily all Blackberry customers), there is no fix available. However, the issue has now been escalated to the development group at RIM. The company’s statement on the issue: “This issue has been escalated internally to our development team. No resolution time frame is currently available.

    Notwithstanding the lack of mitigation, there is a workaround:
    Prevent the BlackBerry Attachment Service from processing PDF files in a BlackBerry Enterprise Server environment

    You can prevent the BlackBerry Attachment Service from processing PDF files by editing the list of file format extensions that the BlackBerry Attachment Service opens, and then preventing the PDF attachment distiller from running on the BlackBerry Attachment Service.

    To remove the PDF file extension from the list of supported file format extensions, complete the following actions:

    1. From the Windows® Desktop, open the BlackBerry Server Configuration tool.
    2. Click the Attachment Server tab.
    3. In the Format Extensions field, delete pdf: from the colon–delimited list of extensions.
    4. Click Apply.
    5. Click OK.
    Until you prevent the PDF attachment distiller from running, the BlackBerry Attachment Service still detects a PDF file with a renamed extension (in other words, its extension is not .pdf) and attempts to process the file automatically. To prevent the PDF attachment distiller from running, complete the following actions:

    On the Windows Desktop, open the BlackBerry Server Configuration tool.
    1. Click the Attachment Server tab.
    2. In the Configuration Option drop-down list, select Attachment Server.
    3. In the Distiller Settings section, next to the distiller name Adobe PDF, clear the check box in the Enabled column.
    4. Click Apply.
    5. Click OK.
    6. On the Windows Desktop, in Administrative Tools, open Services.
    7. Right-click BlackBerry Attachment Service and click Stop.
    8. Right-click BlackBerry Attachment Service and click Start.
    9. Close Services.
    In Microsoft® Exchange and Novell® GroupWise® environments, complete the following additional steps:
    1. On the Windows Desktop, in Administrative Tools, open Services.
    2. Right-click BlackBerry Dispatcher and click Stop.
    3. Right-click BlackBerry Dispatcher and click Start.
    4. Close Services.
    Important: Restarting certain BlackBerry Enterprise Server services will delay email message delivery to BlackBerry smartphones. For more information, see KB04789.

    In IBM® Lotus® Domino® environments, complete the following additional steps:
    1. Open the IBM Lotus Domino Administrator.
    2. Click the Server tab.
    3. Click the Status tab.
    4. Click Server Console.
    5. In the Domino Command field, type tell BES quit and press ENTER.
    6. In the Domino Command field, type load BES and press ENTER.
    7. Close the IBM Lotus Domino Administrator.”
    [source]

  2. #2
    cwax's Avatar
    cwax no está en línea BES Pro
    Join Date
    Sep 2006
    PIN/ID
    32DEF7BB
    Posts
    4,513
    Hurry up Service Pack 6!!




  3. #3
    Hack173's Avatar
    Hack173 no está en línea banned
    Join Date
    May 2007
    PIN/ID
    249E4D70
    Posts
    2,694
    This is only for BES? Right? And not BIS.

    ~via 8320 (wap.pinstack.com)~

  4. #4
    garycutri's Avatar
    garycutri no está en línea Stack level 3
    Join Date
    May 2006
    Posts
    119
    Blackberry Support Forums - Asia Pacific
    www.blackberryforums.com.au

  5. #5
    garycutri's Avatar
    garycutri no está en línea Stack level 3
    Join Date
    May 2006
    Posts
    119
    Vulnerability in the PDF distiller of the BlackBerry Attachment Service for the BlackBerry Enterprise Server


    Doc ID : KB15766
    Last Modified : 2008-07-17
    Document Type : Security Advisory

    Environment
    • BlackBerry® Enterprise Server software version 4.1 Service Pack 3 (4.1.3) through 4.1 Service Pack 5 (4.1.5)
    Overview

    This advisory describes a security issue that the BlackBerry Attachment Service component of the BlackBerry Enterprise Server is susceptible to. The issue relates to a known vulnerability in the PDF distiller component of the BlackBerry Attachment Service that affects how the BlackBerry Attachment Service processes PDF files.
    This vulnerability has a Common Vulnerability Scoring System (CVSS) score of 9.0.

    Problem

    A security vulnerability exists in the PDF distiller of some released versions of the BlackBerry Attachment Service. This vulnerability could enable a malicious individual to send an email message containing a specially crafted PDF file, which when opened for viewing on a BlackBerry smartphone, could cause memory corruption and possibly lead to arbitrary code execution on the computer that the BlackBerry Attachment Service runs on.

    Resolution

    Upgrade to BlackBerry Enterprise Server software version 4.1 Service Pack 6 (4.1.6).

    RIM has also issued an interim security software update that resolves this vulnerability. Visithttp://www.blackberry.com/go/serverdownloads to obtain the interim security software update for affected release versions earlier than BlackBerry Enterprise Server software version 4.1.6.

    Workaround

    Note: As a mobile device best practice, Research In Motion (RIM) recommends that BlackBerry smartphone users open attachments from trusted sources only.

    Prevent the BlackBerry Attachment Service from processing PDF files in a BlackBerry Enterprise Server environment

    You can prevent the BlackBerry Attachment Service from processing PDF files by editing the list of file format extensions that the BlackBerry Attachment Service opens, and then preventing the PDF attachment distiller from running on the BlackBerry Attachment Service.


    To remove the PDF file extension from the list of supported file format extensions, complete the following actions:
    1. From the Windows® Desktop, open the BlackBerry Server Configuration tool.
    2. Click the Attachment Server tab.
    3. In the Format Extensions field, delete pdf: from the colon–delimited list of extensions.
    4. Click Apply.
    5. Click OK.
    Until you prevent the PDF attachment distiller from running, the BlackBerry Attachment Service still detects a PDF file with a renamed extension (in other words, its extension is not .pdf) and attempts to process the file automatically. To prevent the PDF attachment distiller from running, complete the following actions:
    1. On the Windows Desktop, open the BlackBerry Server Configuration tool.
    2. Click the Attachment Server tab.
    3. In the Configuration Option drop-down list, select Attachment Server.
    4. In the Distiller Settings section, next to the distiller name Adobe PDF, clear the check box in the Enabled column.
    5. Click Apply.
    6. Click OK.
    7. On the Windows Desktop, in Administrative Tools, open Services.
    8. Right-click BlackBerry Attachment Service and click Stop.
    9. Right-click BlackBerry Attachment Service and click Start.
    10. Close Services.
    In Microsoft® Exchange and Novell® GroupWise® environments, complete the following additional steps:
    1. On the Windows Desktop, in Administrative Tools, open Services.
    2. Right-click BlackBerry Dispatcher and click Stop.
    3. Right-click BlackBerry Dispatcher and click Start.
    4. Close Services.
    Important: Restarting certain BlackBerry Enterprise Server services will delay email message delivery to BlackBerry smartphones. For more information, see KB04789.


    In IBM® Lotus® Domino® environments, complete the following additional steps:
    1. Open the IBM Lotus Domino Administrator.
    2. Click the Server tab.
    3. Click the Status tab.
    4. Click Server Console.
    5. In the Domino Command field, type tell BES quit and press ENTER.
    6. In the Domino Command field, type load BES and press ENTER.
    7. Close the IBM Lotus Domino Administrator.
    Additional Information

    You can install the BlackBerry Attachment Service on a remote computer and then place that computer on its own network segment to prevent the spread of potential attacks from the BlackBerry Attachment Service to another computer within your organization’s network. In a segmented network, attacks are isolated and contained on a single area of the network. Using segmented network architecture is designed to improve the security and performance of the BlackBerry Attachment Service network segment by filtering out attachment data that is not destined for other network segments. For more information about placing the BlackBerry Enterprise Solution components in a network architecture that is segmented to prevent the spread of potential malware attacks, see Placing the BlackBerry Enterprise Solution in a Segmented Network.

    Visit www.blackberry.com/security for more information on BlackBerry security.

    [FONT=Arial]CVSS is a vendor agnostic, industry open standard designed to convey the severity of vulnerabilities. CVSS scores may be used to determine the urgency for update deployment within an organization. CVSS scores range from 0.0 (no vulnerability) to 10.0 (critical). RIM uses CVSS in vulnerability assessments to present an immutable characterization of security issues. RIM assigns all security relevant issues a non-zero score.[/FONT]
    Blackberry Support Forums - Asia Pacific
    www.blackberryforums.com.au

  6. #6
    j llama's Avatar
    j llama no está en línea Device Pro
    Join Date
    Sep 2006
    PIN/ID
    4U2ASKME
    Posts
    4,319
    Thanks for the info.
    BlackBerry® Certified Support Specialist

  7. #7
    lee.smith's Avatar
    lee.smith no está en línea Stack level 1
    Join Date
    Sep 2006
    Posts
    3
    It looks like RIM have now released a fix for this (released on July 17th)

    Service Pack 5 Interim Security Update

    • File name: bes_as_fix_189456_4.1.5.zip
    • File size: 2.0 MB
    • Date posted: 17-July-2008
    Note: This update addresses a security vulnerability that exists in the PDF distiller of some released versions of the BlackBerry Attachment Service. Please read the release notes before installing this software.

    Download Software
    View Related Documentation

    I have not tested this yet, but will let you know how it goes.

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •