PT-2017-8346 · Blackberry · Blackberry Enterprise Server

Published 2017-01-13 · Updated 2017-01-20 · CVE-2016-3128

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions BlackBerry Enterprise Server versions 12 through 12.5.2

Description A spoofing issue in the Core of BlackBerry Enterprise Server allows remote attackers to enroll an illegitimate device, gain access to device parameters, or send false information by accessing specific details about a legitimately enrolled device.

Recommendations For versions 12 through 12.5.2, update to a version that contains a fix for this issue to prevent remote attackers from exploiting the spoofing vulnerability.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2016-3128

Affected Products

Blackberry Enterprise Server

References · 5

• https://osv.dev/vulnerability/CVE-2016-3128 · Vendor Advisory
• http://support.blackberry.com/kb/articleDetail?articleNumber=000038913 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3128 · Security Note
• http://securitytracker.com/id/1037585 · Note
• http://securityfocus.com/bid/95624 · Note