J-Security Center

Latest Attack Object Updates
  • IDP Daily Update #1537
    posted: 11/06/09
  • NSM Daily Update #1537
    posted: 11/06/09
  • Deep Inspection 5.3r5 and above, 5.4, 6.0 #1537
    posted: 11/06/09
  • Deep Inspection 5.1 and 5.2 #1435
    posted: 11/06/09
  • Deep Inspection 5.0, 5.3r4 and below #1132
    posted: 03/28/08 (04/01/08 for 5.0)
  • Antivirus
    posted: 11/05/09

Title: Blackberry Enterprise Server Attachment Service TIFF Attachment Denial Of Service Vulnerability

Severity: MODERATE

Description:

Research In Motion Blackberry Enterprise Server is communications middleware for Blackberry devices.

Research In Motion Blackberry Enterprise Server is prone to denial of service attacks. This issue affects the Attachment Service and may be triggered by a malformed TIFF attachment.

This issue only affects the server's ability to process attachments for the duration of the denial of service. The denial of service will persist until the Attachment Service is restarted. The service may restart automatically or after a timeout, which defaults to 25 minutes.

The issue is reportedly caused by a heap-based buffer overflow. The vendor has stated that this issue will result in a denial of service, and it is therefore not believed that the issue is exploitable beyond a denial of service. However, other sources indicate that this issue may allow arbitrary code execution to occur upon successful exploitation. Specific details regarding code execution are not currently available and have not been confirmed. This record will be updated when more information is available.

Affected Products:

  • Research In Motion Blackberry Enterprise Server for Domino 4.0.0
  • Research In Motion Blackberry Enterprise Server for Exchange 4.0.0 SP1

References:

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.