BlackBerry: highly critical flaw found in the reading PDFs
By admin at 18 July, 2008, 10:49 am
Security - RIM, the manufacturer and publisher of the BlackBerry solution calls for disabling the feature opening PDF files as attachments. A highly critical flaw was discovered at the BlackBerry Enterprise Server, which will charge. RIM is preparing a fix.
Following the discovery of a flaw, RIM press users of its BlackBerry to turn off reading PDF files.
It should no longer be used, the time that the manufacturer develop a fix, he says in a security bulletin.
No timeframe is specified. In the meantime, RIM said that the BlackBerry Attachment Service may be installed on a remote machine, away, in order not to run any risk to other machines.
A gangway direct access for pirates
The flaw, deemed very critical, lies at the opening by the BlackBerry Enterprise Server (BES), PDF files provided to mail attachments. An attacker could use it to bribe a corporate network, camouflaging code trapped in a PDF file.
The BES is concerned versions 4.1 Service Pack 3 (4.1.3) versions 4.1 Service Pack 5 (4.1.5).
The BES is in most cases placed at critical points such as mail servers, making them ideal gateways for access to hackers. “The BES has a high level of privileges, since access to data stored on the mail server. With such a level, you can do what we want on a mail server or other service domain” , Analyzes the consultant Jason Edelstein, Sense of Security.
The corporate network at risk
“This is one case where the BlackBerry, opening a file, runs a risk”, complete Maarten Van Horenbeeck, a security expert at the Internet Storm Center (ISC). “But more than the machine, especially threats on private data of the company who are in the professional network.”
The BlackBerry deployments fleets pose quite often “problems in terms of architecture,” Jason Edelstein. “Most organizations are deploying BES on a server’s internal network, which connects the facts in the server internal servers RIM, based in Canada.” But if a user loses his BlackBerry, and that is not locked in one way or another, he adds, it is possible to read documents from the company stored on the web.
“To have insurance, we must launch the BlackBerry Internet browser and try to access the resources of the intranet. If we succeed then that the documents in question are not on the web, we must take advantage the alarm, “concludes Jason Edelstein.
No comments yet.