Two recently announced vulnerabilities in BlackBerry Enterprise Server permit a malicious attack that can prevent users from being able to open e-mail attachments, or disrupt the flow of information between BlackBerry Enterprise Server and BlackBerry Router, the system’s developer, Research In Motion Ltd. (RIM), said Tuesday.
The first vulnerability allows an attacker to use a corrupt TIFF image file to cause a heap overflow error that can stop a user’s ability to view attachments, RIM said. The vulnerability was demonstrated on Dec. 30 at the 22nd Chaos Communication Conference in Berlin. That same day, the U.S. Computer Emergency Readiness Team (US-CERT) issued an advisory noting the existence of the vulnerability and referred users to RIM for remediation.
In a posting on its support Web site, RIM said it was aware of the vulnerability and will fix the problem in future releases of BlackBerry Enterprise Server. In the meantime, the company suggested that administrators use a workaround that blocks TIFF attachments.
Detailed information on the workaround is available at this Web site.
The second vulnerability was also demonstrated at the Chaos Communication Conference and noted by US-CERT. This vulnerability is exploited by sending malformed protocol packets that cause a denial of service for all BlackBerry Enterprise Server communication. This vulnerability normally applies only to internal users but can be exploited by an external attacker who is able to manipulate DNS (Domain Name System) queries, RIM said.
The company advised customers to ensure that the BlackBerry Enterprise Server and BlackBerry Router are behind a properly configured firewall to protect them from external attacks. It also advised companies to create static entries in their DNS or hosts tables for the BlackBerry Infrastructure to minimize the risk of DNS hijacking.
RIM has said it will eliminate this vulnerability in a future software release.
Additional information can be found at this Web site.
