ignore security and it'll go away

Register | Login

FilesNewsUsersAuthors

Home Files News About Contact Add New

Showing 1 - 1 of 1

Files

iDEFENSE Security Advisory 2009-01-12.1

Posted Jan 14, 2009

Authored by iDefense Labs, Sean Larsson | Site idefense.com

iDefense Security Advisory 01.12.09 - Remote exploitation of a heap overflow vulnerability in Research In Motion Ltd. (RIM)'s BlackBerry Enterprise Server could allow an attacker to execute arbitrary code with the privileges of the affected service, usually SYSTEM. The vulnerability occurs when parsing a certain stream inside of a PDF file. During parsing, a heap buffer is filled up with without properly checking to see whether the buffer is large enough to hold the current value. By inserting a large number of values, it is possible to overflow the buffer, and corrupt object pointers. This can lead to pointers being controlled, which results in the execution of arbitrary code. iDefense has confirmed the existence of this vulnerability in BlackBerry Enterprise Server version 4.1.5 and 4.1.6 (4.1 SP5, SP6). 4.1.6 is the most current version, as of the publishing of this report. This vulnerability was confirmed in BlackBerry Enterprise Server for Microsoft Exchange, but is believed to affect the Lotus and Novell versions as well. Previous versions may also be affected.

tags | advisory, remote, overflow, arbitrary

MD5 | ccc046a70b456e87ead4ae296c970c41

Download | Favorite | Comments (0)