Smartphone images can hijack BlackBerry servers

Research in Motion has squashed a nasty bug in its BlackBerry server software that allowed it to be commandeered when handset users received messages containing booby-trapped images.

The flaw in various versions of the BlackBerry Enterprise Server carried a Common Vulnerability Scoring System rating of 10, the most severe score possible. The vulnerability resides in a part of the software that processes PNG and TIFF images for rendering on BlackBerry smartphones. An attacker could exploit the flaw by embedding a link to a malicious image in a message or email sent to a BlackBerry user. The user need not click on a link or or image or view the email for the attack to succeed.

“These vulnerabilities could allow an attacker to execute arbitrary code using the privileges of the BlackBerry Enterprise Server login account,” RIM warned in an advisory. Successful exploitation could allow an attacker to gain access to and execute code on the BlackBerry server.

The threat is serious enough that organizations using the BlackBerry server software should patch immediately. If that's not possible, admins can work around the problem by disabling inline images and rich content for smartphone users following instructions here and here.

BlackBerry Enterprise Server version 5.0.3 MR3 and later for Microsoft Exchange and IBM Lotus Domino aren't vulnerable. ®