SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (Other)  >   Blackberry OS Vendors:   Research In Motion Limited
Blackberry Device Software Bug in WebKit Lets Remote Users Execute Code
SecurityTracker Alert ID:  1025212
SecurityTracker URL:  http://securitytracker.com/id/1025212
CVE Reference:   CVE-2011-1290   (Links to External Site)
Date:  Mar 15 2011
Impact:   Execution of arbitrary code via network, User access via network
Vendor Confirmed:  Yes  
Version(s): 6.0 and later
Description:   A vulnerability was reported in Blackberry Device Software. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create specially crafted HTML that, when loaded by the target user, will execute arbitrary code on the target system.

The code can access user data stored on the media card and in the built-in media storage on the BlackBerry smartphone, but not email and other personal information stored on the file system of the BlackBerry smartphone.

The following devices are affected:

* BlackBerry Bold 9650 smartphone
* BlackBerry Bold 9700 smartphone
* BlackBerry Bold 9780 smartphone
* BlackBerry Curve 9300 Series
* BlackBerry Pearl 9100 Series
* BlackBerry Style 9670 smartphone
* BlackBerry Torch 9800 smartphone

This vulnerability was demonstrated at the Pwn2Own 2011 Contest.

Vincenzo Iozzo, Ralf Philipp Weinmann, and Willem Pinckaers reported this vulnerability via TippingPoint's Zero Day Initiative.

Impact:   A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   No solution was available at the time of this entry.

The vendor has described a workaround (disabling the use of JavaScript in the BlackBerry Browser) in their advisory.

The vendor's advisory is available at:

http://www.blackberry.com/btsc/KB26132

Vendor URL:  www.blackberry.com/btsc/KB26132 (Links to External Site)
Cause:   Not specified

Message History:   This archive entry has one or more follow-up message(s) listed below.
Apr 14 2011 (Apple Issues Fix for Safari) Blackberry Device Software Bug in WebKit Lets Remote Users Execute Code
Apple has issued a fix for Apple Safari.
Apr 14 2011 (Apple Issues Fix for iOS) Blackberry Device Software Bug in WebKit Lets Remote Users Execute Code
Apple has issued a fix for iOS (iPhone 3GS and later, iPod touch, and iPad).
Apr 15 2011 (Apple Issues Fix for iOS) Blackberry Device Software Bug in WebKit Lets Remote Users Execute Code
Apple has issued a fix for iOS (iPhone 4 CDMA).
Apr 18 2011 (Apple Issues Fix for iTunes) Blackberry Device Software Bug in WebKit Lets Remote Users Execute Code
Apple has issued a fix for iTunes.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC