PT-2010-4136 · Blackberry · Blackberry Enterprise Server

Publicado 2010-12-17 · Atualizado 2017-08-17 · CVE-2010-2602

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BlackBerry Enterprise Server versions 4.1.6 through 4.1.7 BlackBerry Enterprise Server versions 5.0.0 through 5.0.2

Description The issue is related to multiple buffer overflows in the PDF distiller component of the BlackBerry Attachment Service. This can be exploited by remote attackers using a crafted PDF document, potentially leading to a denial of service (crash) and possibly the execution of arbitrary code.

Recommendations For versions 4.1.6 and 4.1.7, update to a version that fixes the buffer overflows in the PDF distiller component. For versions 5.0.0 through 5.0.2, update to a version that fixes the buffer overflows in the PDF distiller component. As a temporary workaround, consider restricting the handling of PDF documents by the BlackBerry Attachment Service until a patch is available.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-2602

Produtos afetados

Blackberry Enterprise Server

Referências · 8

• http://xforce.iss.net/xforce/xfdb/64066 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64066 · Nota
• http://securityfocus.com/bid/45392 · Nota
• http://vupen.com/english/advisories/2010/3237 · Aviso do Fabricante
• http://securitytracker.com/id?1024891 · Nota
• http://blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB24761 · Aviso do Fabricante
• http://secunia.com/advisories/35632 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2602 · Nota de Segurança