SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   BlackBerry Enterprise Server Vendors:   Research In Motion Limited
(RIM Issues Fix for BlackBerry Enterprise Server) LibTIFF Buffer Overflow in ThunderCode Decoder Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1025913
SecurityTracker URL:  http://securitytracker.com/id/1025913
CVE Reference:   CVE-2011-1167   (Links to External Site)
Date:  Aug 10 2011
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in LibTIFF. A remote user can cause arbitrary code to be executed on the target user's system. BlackBerry Enterprise Server is affected.

A remote user can create a specially crafted image file that, when loaded by the target user or application, will trigger a heap overflow in the ThunderCode decoder and execute arbitrary code on the target system. The code will run with the privileges of the target user or application.

The vendor was notified on January 21, 2011.

Martin Barbella reported this vulnerability via TippingPoint's Zero Day Initiative.

Impact:   A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   RIM has issued a fix for BlackBerry Enterprise Server.

The following versions are affected:

BlackBerry Enterprise Server version 5.0.1 through 5.0.3 MR2 for Microsoft Exchange
BlackBerry Enterprise Server version 5.0.1 through 5.0.3 MR2 for IBM Lotus Domino
BlackBerry Enterprise Server version 4.1.7 and version 5.0.1 through 5.0.1 MR3 for Novell GroupWise
BlackBerry Enterprise Server Express version 5.0.1 through 5.0.3 for Microsoft Exchange
BlackBerry Enterprise Server Express version 5.0.2 and 5.0.3 for IBM Lotus Domino

The RIM advisory is available at:

http://www.blackberry.com/btsc/KB27244

Cause:   Boundary error
Underlying OS:  Windows (2000), Windows (2003), Windows (2008)

Message History:   This archive entry is a follow-up to the message listed below.
Mar 28 2011 LibTIFF Buffer Overflow in ThunderCode Decoder Lets Remote Users Execute Arbitrary Code



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC