BlackBerry Forums Support Community
              

Closed Thread
 
Thread Tools
Old 07-16-2008, 07:22 AM   #1
1fish
Knows Where the Search Button Is
 
Join Date: Dec 2005
Location: Pennsylvania
Model: Bold
PIN: Ummm... No?
Carrier: AT&T
Posts: 32
Default PDF Vulnerability in BlackBerry Attachment Service for BES

Please Login to Remove!

I don't know how many of you saw hdawg's post about the pdf vulnerability for blackberry unite - but apparently it is also applicable for BES:

KB15766 Vulnerability in the PDF distiller of the BlackBerry Attachment Service for the BlackBerry Enterprise Server

Environment

* BlackBerry® Enterprise Server software version 4.1 Service Pack 3 (4.1.3) through 4.1 Service Pack 5 (4.1.5)

Overview

This advisory describes a security issue that the BlackBerry Attachment Service component of the BlackBerry Enterprise Server is susceptible to. The issue relates to a known vulnerability in the PDF distiller component of the BlackBerry Attachment Service that affects how the BlackBerry Attachment Service processes PDF files.

This vulnerability has a Common Vulnerability Scoring System (CVSS) score of 9.0.


Problem

A security vulnerability in the PDF distiller of the BlackBerry Attachment Service could enable a malicious individual to use a specially crafted PDF file attachment in an email message to cause arbitrary code to execute on the computer that the BlackBerry Attachment Service runs on. If a BlackBerry smartphone user on a BlackBerry Enterprise Server opens and views the specially crafted PDF file attachment on the BlackBerry smartphone, the arbitrary code execution could compromise the computer.


Resolution

This issue has been escalated internally to our development team. No resolution time frame is currently available.


Workaround

Note: As a mobile device best practice, Research In Motion (RIM) recommends that BlackBerry smartphone users open attachments from trusted sources only.

Prevent the BlackBerry Attachment Service from processing PDF files in a BlackBerry Enterprise Server environment

You can prevent the BlackBerry Attachment Service from processing PDF files by editing the list of file format extensions that the BlackBerry Attachment Service opens, and then preventing the PDF attachment distiller from running on the BlackBerry Attachment Service.

To remove the PDF file extension from the list of supported file format extensions, complete the following actions:

1. From the Windows® Desktop, open the BlackBerry Server Configuration tool.
2. Click the Attachment Server tab.
3. In the Format Extensions field, delete pdf: from the colon–delimited list of extensions.
4. Click Apply.
5. Click OK.

Until you prevent the PDF attachment distiller from running, the BlackBerry Attachment Service still detects a PDF file with a renamed extension (in other words, its extension is not .pdf) and attempts to process the file automatically. To prevent the PDF attachment distiller from running, complete the following actions:

1. On the Windows Desktop, open the BlackBerry Server Configuration tool.
2. Click the Attachment Server tab.
3. In the Configuration Option drop-down list, select Attachment Server.
4. In the Distiller Settings section, next to the distiller name Adobe PDF, clear the check box in the Enabled column.
5. Click Apply.
6. Click OK.
7. On the Windows Desktop, in Administrative Tools, open Services.
8. Right-click BlackBerry Attachment Service and click Stop.
9. Right-click BlackBerry Attachment Service and click Start.
10. Close Services.

In Microsoft® Exchange and Novell® GroupWise® environments, complete the following additional steps:

1. On the Windows Desktop, in Administrative Tools, open Services.
2. Right-click BlackBerry Dispatcher and click Stop.
3. Right-click BlackBerry Dispatcher and click Start.
4. Close Services.

Important: Restarting certain BlackBerry Enterprise Server services will delay email message delivery to BlackBerry smartphones. For more information, see KB04789.

In IBM® Lotus® Domino® environments, complete the following additional steps:

1. Open the IBM Lotus Domino Administrator.
2. Click the Server tab.
3. Click the Status tab.
4. Click Server Console.
5. In the Domino Command field, type tell BES quit and press ENTER.
6. In the Domino Command field, type load BES and press ENTER.
7. Close the IBM Lotus Domino Administrator.
Offline  
Old 07-16-2008, 07:46 AM   #2
hdawg
BlackBerry Genius
 
hdawg's Avatar
 
Join Date: Aug 2006
Model: hdawg
PIN: port3101.org
Carrier: hdawg
Posts: 6,632
Default

Dupe; I posted a BES one here.
Offline  
Old 07-16-2008, 07:50 AM   #3
1fish
Knows Where the Search Button Is
 
Join Date: Dec 2005
Location: Pennsylvania
Model: Bold
PIN: Ummm... No?
Carrier: AT&T
Posts: 32
Default

My apologies.

I thought it odd that you didn't post both!

I ran a search prior to posting it. ...I must not have looked closely enough.
Offline  
Closed Thread


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


Dyson Ball Multi Floor Corded Upright Vacuum - Fuchsia - Moderately Used picture

Dyson Ball Multi Floor Corded Upright Vacuum - Fuchsia - Moderately Used

$119.00



Appion MGAVCT 1/4 Inches MegaFlow Vacuum-Rated Valve Core Removal Tool picture

Appion MGAVCT 1/4 Inches MegaFlow Vacuum-Rated Valve Core Removal Tool

$52.99



Shop Vacuum upholstery extractor conversion kit auto vac detail carpet or home.  picture

Shop Vacuum upholstery extractor conversion kit auto vac detail carpet or home.

$179.99



GAST Vacuum Pump Model DOA-P104-AA picture

GAST Vacuum Pump Model DOA-P104-AA

$149.00



Cordless Vacuum Cleaner Stick Handheld for Carpet Pet Hair & Wood Floor Bagless picture

Cordless Vacuum Cleaner Stick Handheld for Carpet Pet Hair & Wood Floor Bagless

$96.90



VEVOR Chamber Vacuum Sealer Commercial Vacuum Sealing Bag Packing Machine 260W picture

VEVOR Chamber Vacuum Sealer Commercial Vacuum Sealing Bag Packing Machine 260W

$187.99







Copyright © 2004-2016 BlackBerryForums.com.
The names RIM © and BlackBerry © are registered Trademarks of BlackBerry Inc.