RIM Patches One More BlackBerry Enterprise Server (BES) PDF Flaw

Research In Motion (RIM) has closed another PDF-related security vulnerability in its BlackBerry Enterprise Server (BES) software that could allow attackers to infect corporate machines.

By Al Sacco
Wed, May 27, 2009

BlackBerry-maker Research In Motion (RIM) yesterday issued a security fix to address yet another flaw in its BlackBerry Enterprise Server's (BES) BlackBerry Attachment Service, which processes message attachments for viewing on BlackBerry devices.

BlackBerry Enterprise Server (BES) Diagram

Problems with the BlackBerry Attachment Service are somewhat common at this point, and RIM has fixed multiple issues related to the BES PDF distiller component in the past months.

The problem: Flaws in the BES PDF distiller could allow attackers to distribute messages with malicious PDF files attached that, if opened via BlackBerry, could lead to device memory corruption and in turn, harmful code could be executed on corporate computers hosting the BES Blackberry Attachment Service.

This particular flaw is found in BES version 4.1 Service Pack 3 (4.1.3) through 5.0 and BlackBerry Professional Software 4.1 Service Pack 4 (4.1.4). The vulnerability is a critical one with a Common Vulnerability Scoring System (CVSS) rating of 9.3 out of 10, according to RIM.

If you or your organization employs affected BES software click here to download an interim fix. If you use affected BlackBerry Professional Software you'll want to go here.

Visit RIM's website for more specifics on the vulnerability, as well as a handful of potential workarounds to disable PDF viewing on enterprise BlackBerrys.

Read, "BES 5.0: Five Features CIOs Need to Know About," for details on RIM's latest BES release.

via Heise Online

FREE CIO BlackBerry Newsletter

Get better use out of your BlackBerry and keep up-to-date on the latest developments. Sign-up »

What is Tech Briefcase?

TechBriefcase is a new, free service where IT Professionals can Search, Store and Share IT white papers and content like this. Learn more

Bookmark content

Speed up your research efforts with content across the web.

Search and Store

Find the white papers you need. Create folders for any topic.

View Anywhere

Open your briefcase on your iPhone, tablet or desktop. Share with colleagues.

Don't have an account yet?

You are here: Technology Topics » Security » News

Most Recent Security Stories

White Papers »

The most simple & secure solution for Intranet access from mobile devices

The promise of enterprise mobility means that employees are more productive and address business issues in a timely, untethered manner.

Protecting Against Database Attacks and Insider Threats: Top 5 Scenarios

Read this new eBook to learn the top five scenarios and essential best practices for preventing database attacks and insider threats.

Establishing a Strategy for Database Security is No Longer Optional

The options for securing increasingly valuable databases are very broad and deep, and can be confusing. This research provides an overview of three categories of controls that should be implemented to ensure that enterprise data is protected in the most efficient and effective manner.

Database Activity Monitoring Is Evolving

Read the analyst report and learn how you can leverage the core capabilities of a DAP solution for better database security.

PCI DSS Compliance with Stingray Application Firewall Module

PCI DSS is mandatory for any business that handles confidential cardholder data. Riverbed® Stingray™ Traffic Manager and Stingray Application Firewall Module help with many parts of the PCI DSS specification, notably the web application firewall (WAF) requirements of section 6.6.

PCI DSS Compliance with Stingray Application Firewall Module

Webcasts »

Distributed Database Security with Real-time Monitoring

View this demo and learn how IBM InfoSphere Guardium database activity monitoring can help protect your sensitive data in distributed DBMS environments with a holistic approach to data security and compliance.

Data Privacy and Protection in Production Environments: New Research from Ponemon Institute

Date: Wednesday, June 13, 2012, 1:00 PM EDT / 10:00 AM PDT

In a recent study conducted by Ponemon Institute, fifty-five percent of respondents indicated they were not confident that their organization would be able to detect the loss or theft of sensitive personal information in their company's databases and applications.

Join featured guest Dr. Larry Ponemon from the Ponemon Institute, to discuss these new findings and how to best address the growing number of data breaches and privacy challenges that are facing your organization. This webinar will focus on:

- Understanding the current state of privacy and data protection in the production environment
- Identifying areas of greatest vulnerability
- Keeping data secure without sacrificing productivity
- Enterprise and configurable solutions for multiple applications

Spear Phishing and the Modern Cyber Attack

Learn how IT teams can protect against spear phishing tactics. Harry Sverdlove, chief technology officer of Bit9 offers a frank discussion about spear phishing - the most common technique used in today's advanced attacks. Learn how spear phishing works and three recommendations for IT to protect against modern threats.

Optimizing the world of IT for end-users: Balancing freedom and choice with security and compliance to meet business

Download this eSeminar to hear from experts Ziff Davis Enterprise, VMware and HP and learn how client-side virtualization can improve your organization's performance, while reducing the IT burden of managing and maintaining an increasingly diverse client universe.

Close a Dangerous Vulnerability: Automated Methods for Managing Admin Rights

In this exclusive webcast from Viewfinity, you'll hear how to leverage Group Policy Object settings to close this vulnerability by elevating privileges for standard users.

Getting to Business Value through IT

More companies are adopting business service management practices to better align their business and IT needs. Download this video to hear findings from the 2011 BSM Maturity Benchmark Survey to learn how companies are taking a customer-centric approach to IT management.

Newsletter Sign-Up »

Receive the latest news test, reviews and trends on your favorite technology topics

Choose a newsletter