PT-2014-4196 · Blackberry · Enterprise Server Express For Exchange+6
Published
2014-02-14
·
Updated
2014-02-14
·
CVE-2014-1467
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
BlackBerry Enterprise Service 10 versions prior to 10.2.1
Universal Device Service version 6
Enterprise Server Express for Domino versions prior to 5.0.4
Enterprise Server Express for Exchange versions prior to 5.0.4
Enterprise Server for Domino versions prior to 5.0.4 MR6
Enterprise Server for Exchange versions prior to 5.0.4 MR6
Enterprise Server for GroupWise versions prior to 5.0.4 MR6
Description
The issue allows context-dependent attackers to obtain sensitive information by reading a log file, as cleartext credentials are logged during exception handling.
Recommendations
For BlackBerry Enterprise Service 10 versions prior to 10.2.1, update to version 10.2.1 or later.
For Universal Device Service version 6, there is no information about a newer version that contains a fix for this issue.
For Enterprise Server Express for Domino versions prior to 5.0.4, update to version 5.0.4 or later.
For Enterprise Server Express for Exchange versions prior to 5.0.4, update to version 5.0.4 or later.
For Enterprise Server for Domino versions prior to 5.0.4 MR6, update to version 5.0.4 MR6 or later.
For Enterprise Server for Exchange versions prior to 5.0.4 MR6, update to version 5.0.4 MR6 or later.
For Enterprise Server for GroupWise versions prior to 5.0.4 MR6, update to version 5.0.4 MR6 or later.
As a temporary workaround, consider restricting access to log files to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Blackberry Enterprise Service 10
Enterprise Server Express For Domino
Enterprise Server Express For Exchange
Enterprise Server For Domino
Enterprise Server For Exchange
Enterprise Server For Groupwise
Universal Device Service