PT-2009-5770 · Rim · Blackberry Device+1

Publicado 2009-09-29 · Atualizado 2017-08-17 · CVE-2009-3477

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions RIM BlackBerry Device Software versions 4.5.0 through 4.5.0.172 RIM BlackBerry Device Software versions 4.6.0 through 4.6.0.302 RIM BlackBerry Device Software versions 4.6.1 through 4.6.1.308 RIM BlackBerry Device Software versions 4.7.0 through 4.7.0.178 RIM BlackBerry Device Software versions 4.7.1 through 4.7.1.56

Description The Blackberry Browser does not properly handle "hidden" characters, including a '0' character, in a domain name in the subject's Common Name (CN) field of an X.509 certificate. This allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

Recommendations For RIM BlackBerry Device Software version 4.5.0, update to version 4.5.0.173 or later. For RIM BlackBerry Device Software version 4.6.0, update to version 4.6.0.303 or later. For RIM BlackBerry Device Software version 4.6.1, update to version 4.6.1.309 or later. For RIM BlackBerry Device Software version 4.7.0, update to version 4.7.0.179 or later. For RIM BlackBerry Device Software version 4.7.1, update to version 4.7.1.57 or later.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2009-3477

Produtos afetados

Blackberry Device

Blackberry Browser

Referências · 6

• http://securitytracker.com/id?1022951 · Nota
• http://secunia.com/advisories/36875 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53490 · Nota
• http://securityfocus.com/bid/36528 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3477 · Nota de Segurança
• http://blackberry.com/btsc/viewContent.do?externalId=KB19552 · Aviso do Fabricante