Flawed BlackBerry Browser Certificate Handling Dialogue Box

From RIM's online security advisory:

"This advisory relates to a BlackBerry Browser dialog box that provides information about web site domain names and their associated certificates. The BlackBerry Browser dialog box informs the BlackBerry device user when there is a mismatch between the site domain name and the domain name indicated in the associated certificate, but does not properly illustrate that the mismatch is due to the presence of some hidden characters (for example, null characters) in the site domain name."

The flaw relates to the BlackBerry software's certificate-handling functionality. A hacker could potentially recreate, or "spoof," a site commonly visited by BlackBerry users, such as RIM's BlackBerry.com, by purposely adding "null characters" to the site certificate's Common Name (CN) field. The recently discovered flaw keeps the BlackBerry Browser from correctly identifying mismatched site certificates due to an inability to render said null characters. (See screenshot below for an example of how the BlackBerry Browser box should look when it encounters site certificate issues due to the presence of null characters in site CN fields.)

Accurate BlackBerry Browser Certificate Handling Dialogue Box w/ "Null Character"

The flaw was rated 6.8 (Medium Risk) on a Common Vulnerability Scoring System (CVSS) scale of one to ten, with one representing little or no risk and ten representing very serious risk. CVSS is a vendor agnostic, open standard for the security industry meant to depict the seriousness of vulnerabilities, according to RIM.

The BlackBerry-maker recommends that all BlackBerry users running handheld OS 4.5 or higher check in with their wireless carriers to see if device software updates are available. The problem: I just did a quick search of both AT&T and Verizon's BlackBerry download pages, but in a number of cases I could only locate earlier software versions than those recommended by RIM.

Here's a list that specifies which software should be updated and to which new versions.

Current Software Version

• BlackBerry Device Software v4.5.0.x to v4.5.0.173 or later


• BlackBerry Device Software v4.6.0.x to v4.6.0.303 or later
  
• BlackBerry Device Software v4.6.1.x to v4.6.1.309 or later


• BlackBerry Device Software v4.7.0.x to v4.7.0.179 or later


• BlackBerry Device Software v4.7.1.x to v4.7.1.57 or later

Until you're able to sit down and update your device--or while you wait for your carrier to issue an update--RIM says to use caution when clicking unknown links in SMS text or e-mail messages, even if they're from what appears to be a trusted source. If you encounter a BlackBerry Browser dialogue box like the ones shown in this post, you should choose to close the connection rather than subject yourself to potential phishing-related risk, according to RIM.

More information on BlackBerry security can be located on the company's website.

AS

Via @Banthon