Thursday

Patch issued for PDF security risk to BES servers

To combat a vulnerability in a PDF distiller program, Research in Motion has issued a new security patch for BES servers. Affected BES versions include:

• BlackBerry® Enterprise Server software version 4.1 Service Pack 3 (4.1.3) through 5.0
• BlackBerry® Professional Software 4.1 Service Pack 4 (4.1.4)

RIM commented there were “multiple security vulnerabilities” existing in some version of the enterprise server PDF distiller as a part of the BlackBerry Attachment Service, possibly allowing hackers to send users e-mails in a PDF file specifically crafted to cause memory corruption and code execution of the hosting computer.

Recommendations included applying the patch to BES systems, and meanwhile preventing the attachment service from processing PDF files in the BES environment, or installing the attachment service to a remote network to stop any spread of malicious PDF files.

For the BES server patch, check here.

For patches to a BlackBerry Profession Software system, check here.

General information from RIM’s KB18327 can be found here.