Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2010.0819.2
Vulnerability in BlackBerry Desktop Software
10 May 2012
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Blackberry Desktop Software
Publisher: CCIRC
Operating System: Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2010-2600
Original Bulletin:
http://www.publicsafety.gc.ca/prg/em/ccirc/2010/av10-034-eng.aspx
Revision History: May 10 2012: Corrected details
September 13 2010: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
PUBLIC SAFETY CANADA
CANADIAN CYBER INCIDENT RESPONSE CENTRE
*****************
ADVISORY
*****************
Number: AV10-034
Date: 10 September 2010
********************************************
Vulnerability in BlackBerry Desktop Software
********************************************
PURPOSE
- ---------
The purpose of this advisory is to raise awareness of a vulnerability in
Blackberry Desktop Software.
ASSESSMENT
- -------------
There is a critical vulnerability in the Blackberry Desktop Software. The
vulnerability is caused by the application loading libraries (DLL) in an
insecure manner, which may allow a malicious user to remotely execute code on
an affected system. This can be exploited by tricking a user in opening a file
associated with Blackberry Desktop Software located on a remote WebDAV or SMB
share. The BlackBerry Desktop Manager needs to be running for a malicious user
to exploit this vulnerability.
The CVE number for this vulnerability is CVE-2010-2600.
The CVSS base score is 6.5, or Medium.
Affected Products
- -----------------
BlackBerry Desktop Software (all versions) for PC
SUGGESTED ACTION
- ----------------
Research in Motion (RIM) has released a fix for this vulnerability. CCIRC
recommends that administrators test and deploy these updates at the earliest
opportunity.
Upgrade to version 6.0.0.47.
https://www.blackberry.com/Downloads/contactFormPreload.do?code=A8BAA56554F96369AB93E4F3BB068C22&dl=A2C0D61EB187AB3AFD247A852FAD3647
References:
- -----------
http://secunia.com/advisories/41398
http://secunia.com/advisories/41346
http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB24242
Note to Readers
- ---------------
The Canadian Cyber Incident Response Centre (CCIRC) provides a focal point for
Canada's cyber threat and vulnerability warning, analysis and response. CCIRC
is responsible for assuring the resilience of national critical infrastructure
through monitoring threats and coordinating a federal response to cyber
security incidents of national interest. CCIRC operates in conjunction with the
Government Operations Centre (GOC) within Public Safety Canada and is a key
component of the government's all-hazards approach to emergency management and
national security.
For general inquires into the role of Public Safety Canada, please contact the
department's Public Affairs division at:
Telephone: 613-944-4875 or 1-800-830-3118
Fax: 613-998-9589
E-mail: communications@ps-sp.gc.ca
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBT6ssF+4yVqjM2NGpAQIm6hAAnej6y5ez3oYxIpssfRlCzbT8Ps8Bbpj7
u1eLmsf/qoVm+ksSqhnrwL5v8iflQnD/WC0CI55z7UQxQF575Dx9QdJgbJYSl4Yi
XduGX3QIbI4tJtq3yMecEU1IYeake9AD+pcVqa2D9/US1UNujUQN15D/ERDf5OXN
wFlKkXHJwTJhXh0sIQZMJe0wAET0OUQF3bBXgH1WPAiT74IaxWlkkiG7R4NPVS9l
e7LKI/dJKUphQd3LorvCelHZ+ingyi7x+Fu1SF3ureqhu+1rkfZXjLz1GLTYIEVa
Dh0W7vkpwcGEcgg/DD1grb8ENKWVkszl+Eiaw0Sa1WUehF7wysjd//zPASkJ0kza
Gf63vxVSPwwtlEgTNoCGnAgKuMYdrSKwWAj2g+idF05/lm+n3lBCe2mTT7WnH3uV
0uItNvsk+nFzm2Ly+CY99aV1ZuNsR6nnuT+53rePpkrXQxMs5VCx/Vw8V9F3Lvzz
+3sSppdoQm6NKleV22/dErIuzwcWQ3x+tFyynROAe6QKr1SF4CKUlasjTJetY2C/
LA/1lwt1z+zQOGyIkcmUWoh2WdFhm7jFIAfa4J1zVr8KxZgtrk0ss9XMpGrOCAJe
1q8vNRb9wUcQU+8euTxZIqcclKzrBwiCep4Koybmy823yEleHDNzUJ+XxROzW/dJ
5pNp/wtZQr4=
=IYxz
-----END PGP SIGNATURE-----