PT-2009-2971 · Blackberry+1 · Blackberry Application Web Loader+1

Andre Protas + 2 · Published 2009-02-10 · Updated 2009-02-17 · CVE-2009-0305

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BlackBerry Application Web Loader version 1.0

Description The issue is related to multiple stack-based buffer overflows in the Research in Motion RIM AxLoader ActiveX control. This can be exploited by remote attackers to execute arbitrary code, potentially through the use of the load or loadJad method.

Recommendations For BlackBerry Application Web Loader version 1.0, as a temporary workaround, consider disabling the load and loadJad methods until a patch is available. Restrict access to the AxLoader ActiveX control to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-0305

Affected Products

Blackberry Application Web Loader

Rim Axloader Activex Control

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2009-0305 · Security Note
• http://blackberry.com/btsc/KB16248 · Vendor Advisory
• http://secunia.com/advisories/33847 · Vendor Advisory
• http://securityfocus.com/bid/33663 · Note
• http://osvdb.org/51833 · Note
• http://microsoft.com/technet/security/advisory/960715.mspx · Note
• http://kb.cert.org/vuls/id/131100 · Note