PT-2013-4570 · Red Hat+1 · Jboss+1

Published 2013-10-11 · Updated 2013-10-15 · CVE-2013-3693

Positive Technologies (AI Summary)

CVSS v2.0

7.9

High

Base vector

AV:A/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BlackBerry Enterprise Service (BES) versions 10.0 through 10.1.2

Description The issue concerns the BlackBerry Universal Device Service in BlackBerry Enterprise Service (BES), which fails to properly restrict access to the JBoss Remote Method Invocation (RMI) interface. This allows remote attackers to upload and execute arbitrary packages by sending a request to port 1098.

Recommendations For versions 10.0 through 10.1.2, restrict access to the JBoss RMI interface on port 1098 to prevent remote attackers from uploading and executing arbitrary packages.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-3693

Affected Products

Blackberry Enterprise Service

Jboss

References · 3

• http://secunia.com/advisories/55187 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3693 · Security Note
• http://btsc.webapps.blackberry.com/btsc/viewdocument.do%3Bjsessionid=1C7CE6911426BCFAF2A80C3834F4DF0F?externalId=KB35139&sliceId=1&cmd=displayKC&docType=kc&noCount=true&ViewedDocsListHelper=com.kanisa.apps.common.BaseViewedDocsListHelperImpl · Note