Smartphone images can hijack BlackBerry servers
RIM squashes high-severity bug
Customer Success Testimonial: Recovery is Everything
Research in Motion has squashed a nasty bug in its BlackBerry server software that allowed it to be commandeered when handset users received messages containing booby-trapped images.
The flaw in various versions of the BlackBerry Enterprise Server carried a Common Vulnerability Scoring System rating of 10, the most severe score possible. The vulnerability resides in a part of the software that processes PNG and TIFF images for rendering on BlackBerry smartphones. An attacker could exploit the flaw by embedding a link to a malicious image in a message or email sent to a BlackBerry user. The user need not click on a link or or image or view the email for the attack to succeed.
“These vulnerabilities could allow an attacker to execute arbitrary code using the privileges of the BlackBerry Enterprise Server login account,” RIM warned in an advisory. Successful exploitation could allow an attacker to gain access to and execute code on the BlackBerry server.
The threat is serious enough that organizations using the BlackBerry server software should patch immediately. If that's not possible, admins can work around the problem by disabling inline images and rich content for smartphone users following instructions here and here.
BlackBerry Enterprise Server version 5.0.3 MR3 and later for Microsoft Exchange and IBM Lotus Domino aren't vulnerable. ®
COMMENTS
Yet another reason...
For ensuring that the BES 'rendering' component is isolated on its own server(s) firewalled away from the rest of your BES infrastructure. Because the rendering service is on the BES infrastructure it is a potential backdoor on to a enterprise network.
This is not the first time the 'rendering' service has been a security hole .. PDF rendering has been an issue a number of times.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
