Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2006.0026 -- [Win]
RIM BlackBerry Enterprise Server Attachment Service does not
properly handle PNG image files
11 January 2006
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: BlackBerry Enterprise Server (BES)
Publisher: US-CERT
Operating System: Windows
Impact: Execute Arbitrary Code/Commands
Denial of Service
Access: Remote/Unauthenticated
CVE Names: CVE-2005-2344
Original Bulletin: http://www.kb.cert.org/vuls/id/646976
- --------------------------BEGIN INCLUDED TEXT--------------------
US-CERT Vulnerability Note VU#646976
RIM BlackBerry Enterprise Server Attachment Service does not properly
handle PNG image files
Overview
The Research in Motion (RIM) BlackBerry Attachment Service contains
a vulnerability in the way the service handles PNG files. By causing
the service to render a specially crafted PNG file and convincing a
user to view the file on a BlackBerry Handheld device, an attacker
could execute arbitrary code or cause a denial of service to the
Attachment Service.
I. Description
The BlackBerry Attachment Service is a component of the BlackBerry
Enterprise Server (BES). The BlackBerry Attachment Service renders
certain types of files sent as email attachments for display on
BlackBerry Handhelds and other BlackBerry client devices. A
vulnerability in the way the service renders Portable Network Graphic
(PNG) format image files could allow an attacker supplying a specially
crafted PNG file to execute arbitrary code or cause the service to
stop functioning. A user must view the attacker-supplied attachment
on a BlackBerry Handheld in order to trigger the vulnerability.
The underlying vulnerability may be related to the way PNG uses zlib.
II. Impact
By supplying a specially crafted PNG image as an email attachment and
convincing a user to view the image on a BlackBerry Handheld, a remote,
unauthenticated attacker could execute arbitrary code or cause a
denial of service to the Blackberry Attachment Service. The attacker
may be able to take control of a vulnerable system.
A denial of service may only affect some users, and the Attachment
Service may start new threads immediately or after a specified time
period (25 minutes by default).
III. Solution
Upgrade
From RIM Technical Knowledge Center article KB-04756:
For Microsoft Exchange
Install BlackBerry Enterprise Server 4.0 Service Pack 3, then
install version 4.0 Service Pack 3, Hotfix 1.
For IBM Lotus Domino and Novell GroupWise
Install BlackBerry Enterprise Server 4.0 Service Pack 3.
To obtain the BlackBerry Enterprise Server software, go to
http://www.blackberry.com/Downloads
Disable PNG processing, image attachment distiller, and/or Attachment Service
As described in RIM Technical Knowledge Center article KB-04756, "An
administrator can exclude PNG images from being processed by the
Attachment Service in the BlackBerry Enterprise Server, or disable
the Attachment Service completely."
Systems Affected
Vendor Status Date Updated
Research in Motion (RIM) Vulnerable 9-Jan-2006
References
http://events.ccc.de/congress/2005/fahrplan/events/596.en.html
http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/728075/728850/728215/?nodeid=1167794
Credit
This vulnerability was reported by FX of Phenoelit. Thanks to RIM for
information used in this document.
This document was written by Art Manion.
Other Information
Date Public 12/27/2005
Date First Published 01/09/2006 03:58:52 PM
Date Last Updated 01/09/2006
CERT Advisory
CVE Name CVE-2005-2344
Metric 17.55
Document Revision 22
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBQ8SmVSh9+71yA2DNAQLyggP+JkDazFaSFJUGOhSWQWuXXYKVN4d855el
fCooxHXhyT6sIxIA8Cz0wDZ5Z3BEofx4eYEs0NhoQsBso4Q76TPljhTi4HpARJ49
+2OFlSujUa8EFrgpPF4kTcqKZYCZenaYDhy6dYmwm7buzm/PFW+6t/qmV8oqPsRv
qyyzwyRkZ0Q=
=FXo8
-----END PGP SIGNATURE-----