PT-2009-5371 · Blackberry+2 · Blackberry Desktop Manager+2

Francis Provencher · Published 2009-09-01 · Updated 2017-09-19 · CVE-2009-3038

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: BlackBerry Desktop Manager version 5.0.0.11 Lotus Notes connector using lnresobject.dll version 7.1.1.119

Description: The issue allows remote attackers to cause a denial of service, specifically an Internet Explorer crash, by referencing a certain ActiveX control's CLSID in the classid attribute of an OBJECT element.

Recommendations: For BlackBerry Desktop Manager version 5.0.0.11, consider disabling the ActiveX control in lnresobject.dll to prevent the denial of service. For the Lotus Notes connector using lnresobject.dll version 7.1.1.119, restrict access to the OBJECT element referencing the control's CLSID until a fix is available.

Exploit

Fix

Related Identifiers

CVE-2009-3038

Affected Products

Blackberry Desktop Manager

Internet Explorer

Lotus Notes

References · 3

• 🔥 http://exploit-db.com/exploits/9517 · Exploit
• 🔥 https://exploit-db.com/exploits/9517 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-3038 · Security Note