=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2009/VULN204
_____________________________________________________________________

DATE                      : 27/05/2009

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running BlackBerry Attachment Service.

======================================================================
http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB18327
______________________________________________________________________

Vulnerabilities in the PDF distiller of the BlackBerry Attachment
Service for the BlackBerry Enterprise Server

Doc ID : KB18327
Last Modified : 05-26-2009
Document Type : Security Advisory

Environment

    * BlackBerry® Enterprise Server software version 4.1 Service Pack 3
(4.1.3) through 5.0
    * BlackBerry® Professional Software 4.1 Service Pack 4 (4.1.4)

Note

This advisory does not replace KB17953, KB15766, and KB17118, which
describe earlier, similar vulnerabilities. For the convenience of
affected customers, the fixes for KB17953, KB15766, and KB17118 are
included in the software update provided for the new vulnerabilities
described in this security advisory. Customers affected by the issues
described in this advisory should also review KB17953, KB15766, and
KB17118 to review how they are protected from the vulnerability
described in that advisory after applying either the updates provided
in KB17953, KB15766, and KB17118, or the one provided in this advisory.


Overview

This advisory describes security issues that the BlackBerry Attachment
Service component of the BlackBerry Enterprise Server is susceptible
to. The issues relate to the handling of malformed and possibly malicious
PDF files.

Issue Severity: These vulnerabilities each have a Common Vulnerability
Scoring System (CVSS) score of 9.3.

Issue Status: Vulnerability confirmed. Software containing security update
released.

Recommendation: Complete the resolution actions documented in this
advisory.


References:

Reference                       Value Related
BlackBerry security advisories 	KB17953, KB15766, KB17118


Problem

Multiple security vulnerabilities exist in the PDF distiller of some
released versions of the BlackBerry Attachment Service. These vulnerabilities
could enable a malicious individual to send an email message containing a
specially crafted PDF file, which when opened for viewing on a BlackBerry
smartphone, could cause memory corruption and possibly lead to arbitrary
code execution on the computer that hosts the BlackBerry Attachment Service.


Resolution

Research In Motion (RIM) has issued an interim security software update that
resolves these vulnerabilities in affected versions of the BlackBerry Enterprise
Server and BlackBerry Professional Software.

For BlackBerry Enterprise Server version 5.0

    * Visit http://www.blackberry.com/go/serverdownloads to obtain Interim
Security Update 2 for BlackBerry Enterprise Server software version 5.0

For BlackBerry Enterprise Server version 4.1.x

    * Visit http://www.blackberry.com/go/serverdownloads to obtain Interim
Security Update 4 for BlackBerry Enterprise Server software version 4.1.x.

For BlackBerry Professional Software

    * Visit http://na.blackberry.com/eng/support/downloads/#tab_professional to
obtain Interim Security Update 4 for affected BlackBerry Professional Software
versions.


Workaround

Note: As a mobile device best practice, Research In Motion (RIM) recommends that
BlackBerry smartphone users open attachments from trusted sources only.
Prevent the BlackBerry Attachment Service from processing PDF files in a BlackBerry
Enterprise Server environment

You can prevent the BlackBerry Attachment Service from processing PDF files
by editing the list of file format extensions that the BlackBerry Attachment
Service opens, and then preventing the PDF attachment distiller from running
on the BlackBerry Attachment Service.

To remove the PDF file extension from the list of supported file format extensions,
complete the following actions:

For BlackBerry Enterprise Server versions earlier than 5.0, and BlackBerry
Professional Software

   1. From the Windows Desktop, open the BlackBerry Server Configuration tool.
   2. Click the Attachment Server tab.
   3. In the Format Extensions field, delete pdf: from the colon–delimited list of extensions.
   4. Click Apply.
   5. Click OK.

For BlackBerry Enterprise Server version 5.0 or later

   1. In the BlackBerry Administration Service, on the Servers and components
menu, expand BlackBerry Solution topology > BlackBerry Domain > Component view
> Attachment > Connector.
   2. Click the BlackBerry Attachment Connector instance that is associated
with the BlackBerry Attachment Service that you want to change.
   3. In the Suport Attachment Server instances tab, click Edit instance.
   4. Click the Edit icon.
   5. Click the Delete icon for the PDF extension.
   6. Click Save all.

Until you prevent the PDF attachment distiller from running, the BlackBerry
Attachment Service still detects a PDF file with a renamed extension (in other
words, its extension is not .pdf) and attempts to process the file automatically.

To prevent the PDF attachment distiller from running, complete the following actions:

For BlackBerry Enterprise Server versions earlier than 5.0, and BlackBerry
Professional Software

   1. On the Windows Desktop, open the BlackBerry Server Configuration tool.
   2. Click the Attachment Server tab.
   3. In the Configuration Option drop-down list, select Attachment Server.
   4. In the Distiller Settings section, next to the distiller name Adobe PDF,
clear the check box in the Enabled column.
   5. Click Apply.
   6. Click OK.
   7. On the Windows Desktop, in Administrative Tools, open Services.
   8. Right-click BlackBerry Attachment Service and click Stop.
   9.
      Right-click BlackBerry Attachment Service and click Start.
  10.
      Close Services.

For BlackBerry Enterprise Server version 5.0 or later

   1. In the BlackBerry Administration Service, on the Servers and
components menu, expand BlackBerry Solution topology > BlackBerry Domain >
Component view > Attachment > Server.
   2. Click the instance that you want to change.
   3. Click Edit instance.
   4. In the Distiller section, in the Allowed column, specify which
distillers are supported for the instance.
   5. Click Save.
   6. Restart the BlackBerry Attachment Service.


For all versions


In Microsoft Exchange and Novell GroupWise environments, complete the
following additional steps:

   1. On the Windows Desktop, in Administrative Tools, open Services.
   2. Right-click BlackBerry Dispatcher and click Stop.
   3. Right-click BlackBerry Dispatcher and click Start.
   4. Close Services.

Note: Restarting BlackBerry Enterprise Server services might delay message
delivery to BlackBerry devices. For more information, see KB04789.


In IBM Lotus Domino environments, complete the following additional steps:


For BlackBerry Enterprise Server versions earlier than 5.0, and BlackBerry
Professional Software

   1. Open the Lotus Domino Administrator.
   2. Click the Server tab.
   3. Click the Status tab
   4. Click Server Console.
   5. In the Domino Command field, type tell BES quit and press ENTER.
   6. In the Domino Command field, type load BES and press ENTER.
   7. Close the Lotus Domino Administrator.

For BlackBerry Enterprise Server version 5.0 or later

Note: You should not use the IBM® Lotus® Domino® console to stop and start
the BlackBerry Messaging Agent. If you use the IBM Lotus Domino console,
the BlackBerry Messaging Agent libraries might not load properly and, if
you configure high availability, the BlackBerry Messaging Agent might not
start correctly as the primary or standby instance.


   1. Stop and start the BlackBerry Controller service and BlackBerry Dispatcher
service in the Windows Services, or stop and start the BlackBerry Enterprise Server
in the BlackBerry Administration Service.


Additional Information

You can install the BlackBerry Attachment Service on a remote computer and
then place that computer on its own network segment to prevent the spread
of potential attacks from the BlackBerry Attachment Service to another
computer within your organization’s network. In a segmented network, attacks
are isolated and contained on a single area of the network. Using segmented
network architecture is designed to improve the security and performance of
the BlackBerry Attachment Service network segment by filtering out attachment
data that is not destined for other network segments. For more information
about placing the BlackBerry Enterprise Solution components in a network
architecture that is segmented to prevent the spread of potential malware
attacks, see Placing the BlackBerry Enterprise Solution in a Segmented Network.

CVSS is a vendor agnostic, industry open standard designed to convey the severity
of vulnerabilities. CVSS scores may be used to determine the urgency for update
deployment within an organization. CVSS scores range from 0.0 (no vulnerability)
to 10.0 (critical). RIM uses CVSS in vulnerability assessments to present an
immutable characterization of security issues. RIM assigns all security relevant
issues a non-zero score.

Visit www.blackberry.com/security for more information on BlackBerry security.

Products

    * BlackBerry Enterprise Server
    * BlackBerry Professional Software

======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================