Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2011.0725
Vulnerability in a BlackBerry Enterprise Server component could allow
information disclosure and partial denial of service
13 July 2011
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: BlackBerry Enterprise Server
Publisher: RIM
Operating System: Windows
Netware
Linux variants
Solaris
AIX
Impact/Access: Denial of Service -- Existing Account
Access Privileged Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2011-0287
Original Bulletin:
http://btsc.webapps.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB27258
- --------------------------BEGIN INCLUDED TEXT--------------------
Vulnerability in a BlackBerry Enterprise Server component could allow
information disclosure and partial denial of service
Products
Affected Software
This issue affects the BlackBerry Administration Application Programming
Interface (API) component within the BlackBerry Administration Service
component of the following software versions:
BlackBerry Enterprise Server version 5.0.0 for Microsoft Exchange, IBM
Lotus Domino and Novell GroupWise (with the BlackBerry Administration
API component installed as an option only)
BlackBerry Enterprise Server Express 5.0.0 for Microsoft Exchange and IBM
Lotus Domino (with the BlackBerry Administration API component installed
as an option only)
BlackBerry Enterprise Server Express versions 5.0.1, 5.0.2 and 5.0.3 for
Microsoft Exchange
BlackBerry Enterprise Server Express versions 5.0.2 and 5.0.3 for IBM Lotus
Domino
BlackBerry Enterprise Server versions 5.0.1, 5.0.2 and 5.0.3 for Microsoft
Exchange and IBM Lotus Domino
BlackBerry Enterprise Server versions 5.0.1 for GroupWise
Non Affected Software
BlackBerry Device Software
BlackBerry Desktop Software
BlackBerry Internet Service
Are BlackBerry smartphones and the BlackBerry Device Software affected?
No.
Issue Severity
This vulnerability has a Common Vulnerability Scoring System (CVSS) score of
4.8.
Overview
This advisory describes a security issue in the BlackBerry Administration API
component. Successful exploitation of the vulnerability could result in
information disclosure and partial denial of service (DoS).
The BlackBerry Administration API is a BlackBerry Enterprise Server component
that is installed on the server that hosts the BlackBerry Administration
Service. The BlackBerry Administration API contains multiple web services that
receive API requests from client applications. The BlackBerry Administration
API then translates requests into a format that the BlackBerry Administration
Service can process.
Who should read this advisory
BlackBerry Enterprise Server administrators.
Who should apply the software fix(es)
BlackBerry Enterprise Server administrators.
Recommendation
Complete the resolution actions documented in this advisory.
Best practices
Consider installing the BlackBerry Enterprise Server in a segmented
network configuration. To configure the BlackBerry Enterprise Solution in
a segmented network, you must install each BlackBerry Enterprise Solution
component on a computer that is separate from the computers that host other
components and then place each computer it its own network segment. A
segmented network architecture is designed to isolate attacks and contain
them on one computer. See Additional Information, below.
References
CVE Identifier: CVE-2011-0287.
Problem
A vulnerability exists in the BlackBerry Administration API which could allow an
attacker to read files that contain only printable characters on the BlackBerry
Enterprise Server, including unencrypted text files. Binary file formats,
including those used for message storage, are not affected. This vulnerability
is limited to the user permissions granted to the BlackBerry Administration API
component.
Impact
Successful exploitation of this issue could allow information disclosure.
Successful exploitation may also result in resource exhaustion and therefore
could be leveraged as a partial denial of service (DoS).
Resolution
RIM has issued the following releases and interim security software updates
that resolve the vulnerability in affected versions of the BlackBerry
Enterprise Server:
For BlackBerry Enterprise Server Express versions 5.0.1, 5.0.2 and 5.0.3 for
Microsoft Exchange
Visit http://www.blackberry.com/go/serverdownloads to obtain the Interim
Security Software Update for July 12, 2011 for BlackBerry Enterprise Server
Express version 5.0.1 - 5.0.3.
For BlackBerry Enterprise Server Express version 5.0.2 and 5.0.3 for IBM Lotus
Domino
Visit http://www.blackberry.com/go/serverdownloads to obtain Interim
Security Software Update for July 12, 2011 for BlackBerry Enterprise Server
Express version 5.0.2 and 5.0.3.
For BlackBerry Enterprise Server versions 5.0.1, 5.0.2 and 5.0.3 for Microsoft
Exchange and IBM Lotus Domino
Visit http://www.blackberry.com/go/serverdownloads to obtain Interim
Security Software Update for July 12, 2011 for BlackBerry Enterprise Server
software version 5.0.1 - 5.0.3.
For BlackBerry Enterprise Server version 5.0.1 for Novell GroupWise
Visit http://www.blackberry.com/go/serverdownloads to obtain Interim
Security Software Update for July 12, 2011 for BlackBerry Enterprise Server
software version 5.0.1.
If you are using a software version that is not listed above, update to one of
the listed versions before applying the interim security software update.
Additional Information
What is network segmentation?
The administrator can install the BlackBerry Attachment Service on a remote
computer and then place that computer on its own network segment to prevent the
spread of potential attacks from the BlackBerry Attachment Service to another
computer within your organizations network. In a segmented network, attacks are
isolated and contained on a single area of the network. Using segmented network
architecture is designed to improve the security and performance of the
BlackBerry Attachment Service network segment by filtering out attachment data
that is not destined for other network segments. For more information about
placing the BlackBerry Enterprise Solution components in a network architecture
that is segmented to prevent the spread of potential malware attacks, see
Placing the BlackBerry Enterprise Solution in a Segmented Network.
What is CVE?
Common Vulnerabilities and Exposures (CVE) is a dictionary of common names
(CVE Identifiers) for publicly known information security vulnerabilities
maintained by the MITRE corporation.
What is CVSS?
CVSS is a vendor agnostic, industry open standard designed to convey the
severity of vulnerabilities. CVSS scores may be used to determine the urgency
for update deployment within an organization. CVSS scores range from 0.0 (no
vulnerability) to 10.0 (critical). RIM uses CVSS for vulnerability assessments
to present an immutable characterization of security issues. RIM assigns all
relevant security issues a non-zero score.
Visit www.blackberry.com/security for more information on BlackBerry security.
Acknowledgements
RIM would like to thank Richard Leach of NGSSecure for his involvement in
helping to protect our customers.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBTh0KKe4yVqjM2NGpAQKaHQ/+Peu6K7HXYoprhp2X5rGrbcjLkPS0fLw4
VOjqEwWFJFReqXZ7Ll06BUE+AuJCelrqAlLvDf3QotvHx6DORPIg5GsfU+Fs6a6P
FMVjWwGsYC8+dSTCJYsqlVltfpLLUZtENEYcCfkrqKtC/EBdjCbuBXpYtek8+U22
ov2Melsi1zylGQUgV/X83Hnrn2WSJ6XWFaHZg56P2Jva97TaI6MAyDkvYTatZL+Z
tEgUS337JupY5IcaHQ4qcDjuJ1vdzzr2hGhnwmoMXJt68rexpoAnqHcd+geH57Pg
UWsS87g6+DqMJSn53X8pu/KS//VcNzdr0RwUkmx12p1IJZDyqsR34/xW2Qpbt2Oo
mAUp3SJPmHR8W+LoERI5dVYaz4XgbAp6f+B/TUCBcI+2REVzEGKatr8vANd94NBN
4IJ4WovB2JUVT/b32gVbULbXXrNbrly1WRPAwoaEQBnxVePK1Sc1Pp8/m2QozfdI
kxODUuj5B8dcGLjU5vM5WXkNceMbDke8YBABa5sW7azK4GDMVwNJUbMKj68gsymC
j0MA8pb+vnu+pkO2/M9ApfgIQGhcks67qUpo+CZ7kCFAkQ8m+B8mwJO1IuqThbXq
35Tx2HlmaW0SyTA530cukyMNp7NascAoS+uMXZ+DRLyeuqUeQkYg1UF1cA06Eb/u
6njbG04DRc8=
=YThJ
-----END PGP SIGNATURE-----