10 May 2012
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2010.0819.2 Vulnerability in BlackBerry Desktop Software 10 May 2012 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Blackberry Desktop Software Publisher: CCIRC Operating System: Windows Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2010-2600 Original Bulletin: http://www.publicsafety.gc.ca/prg/em/ccirc/2010/av10-034-eng.aspx Revision History: May 10 2012: Corrected details September 13 2010: Initial Release - --------------------------BEGIN INCLUDED TEXT-------------------- PUBLIC SAFETY CANADA CANADIAN CYBER INCIDENT RESPONSE CENTRE ***************** ADVISORY ***************** Number: AV10-034 Date: 10 September 2010 ******************************************** Vulnerability in BlackBerry Desktop Software ******************************************** PURPOSE - --------- The purpose of this advisory is to raise awareness of a vulnerability in Blackberry Desktop Software. ASSESSMENT - ------------- There is a critical vulnerability in the Blackberry Desktop Software. The vulnerability is caused by the application loading libraries (DLL) in an insecure manner, which may allow a malicious user to remotely execute code on an affected system. This can be exploited by tricking a user in opening a file associated with Blackberry Desktop Software located on a remote WebDAV or SMB share. The BlackBerry Desktop Manager needs to be running for a malicious user to exploit this vulnerability. The CVE number for this vulnerability is CVE-2010-2600. The CVSS base score is 6.5, or Medium. Affected Products - ----------------- BlackBerry Desktop Software (all versions) for PC SUGGESTED ACTION - ---------------- Research in Motion (RIM) has released a fix for this vulnerability. CCIRC recommends that administrators test and deploy these updates at the earliest opportunity. Upgrade to version 126.96.36.199. https://www.blackberry.com/Downloads/contactFormPreload.do?code=A8BAA56554F96369AB93E4F3BB068C22&dl=A2C0D61EB187AB3AFD247A852FAD3647 References: - ----------- http://secunia.com/advisories/41398 http://secunia.com/advisories/41346 http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB24242 Note to Readers - --------------- The Canadian Cyber Incident Response Centre (CCIRC) provides a focal point for Canada's cyber threat and vulnerability warning, analysis and response. CCIRC is responsible for assuring the resilience of national critical infrastructure through monitoring threats and coordinating a federal response to cyber security incidents of national interest. CCIRC operates in conjunction with the Government Operations Centre (GOC) within Public Safety Canada and is a key component of the government's all-hazards approach to emergency management and national security. For general inquires into the role of Public Safety Canada, please contact the department's Public Affairs division at: Telephone: 613-944-4875 or 1-800-830-3118 Fax: 613-998-9589 E-mail: firstname.lastname@example.org - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to email@example.com and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: firstname.lastname@example.org Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBT6ssF+4yVqjM2NGpAQIm6hAAnej6y5ez3oYxIpssfRlCzbT8Ps8Bbpj7 u1eLmsf/qoVm+ksSqhnrwL5v8iflQnD/WC0CI55z7UQxQF575Dx9QdJgbJYSl4Yi XduGX3QIbI4tJtq3yMecEU1IYeake9AD+pcVqa2D9/US1UNujUQN15D/ERDf5OXN wFlKkXHJwTJhXh0sIQZMJe0wAET0OUQF3bBXgH1WPAiT74IaxWlkkiG7R4NPVS9l e7LKI/dJKUphQd3LorvCelHZ+ingyi7x+Fu1SF3ureqhu+1rkfZXjLz1GLTYIEVa Dh0W7vkpwcGEcgg/DD1grb8ENKWVkszl+Eiaw0Sa1WUehF7wysjd//zPASkJ0kza Gf63vxVSPwwtlEgTNoCGnAgKuMYdrSKwWAj2g+idF05/lm+n3lBCe2mTT7WnH3uV 0uItNvsk+nFzm2Ly+CY99aV1ZuNsR6nnuT+53rePpkrXQxMs5VCx/Vw8V9F3Lvzz +3sSppdoQm6NKleV22/dErIuzwcWQ3x+tFyynROAe6QKr1SF4CKUlasjTJetY2C/ LA/1lwt1z+zQOGyIkcmUWoh2WdFhm7jFIAfa4J1zVr8KxZgtrk0ss9XMpGrOCAJe 1q8vNRb9wUcQU+8euTxZIqcclKzrBwiCep4Koybmy823yEleHDNzUJ+XxROzW/dJ 5pNp/wtZQr4= =IYxz -----END PGP SIGNATURE-----