RIM patches BlackBerry Enterprise Server

Research In Motion (RIM) has released a security advisory to address numerous vulnerabilities in the BlackBerry Attachment Service, a component of the BlackBerry Enterprise Server, which could allow an attacker to execute arbitrary code.

The bugs relate to the way malicious or malformed PDF files are handled by the PDF distiller of some versions of the Attachment Service, RIM said in its advisory.

The vulnerabilities could cause memory corruption, lead to a denial-of-service (DoS) condition or arbitrary code execution, RIM said. An attacker could exploit the flaws by convincing a user to open a malicious PDF file on a BlackBerry smartphone that is associated with a user account on a vulnerable version of BlackBerry Enterprise Server, RIM said.

Affected versions are BlackBerry Enterprise Server versions 4.1.3 through 4.1.7 and version 5.0.0 running on Microsoft Windows version 2000, 2003 or 2008, as well as BlackBerry Professional Software 4.1.4.

US-CERT has encouraged users and administrators to review BlackBerry's advisory and apply the updates.

See original article on scmagazineus.com