This vulnerability has a Common Vulnerability Scoring System (CVSS) score of 3.5 .
This advisory describes a security issue whereby the MDS Connection Service of the BlackBerry Enterprise Server is susceptible to a potential cross site scripting vulnerability. The issue relates to the handling of malformed URLs .
Issue Status: Vulnerability confirmed. Software containing security update released.
A security vulnerability exists in the MDS Connection Service of the BlackBerry Enterprise Server Version 4.1.6 MR4 and earlier. This vulnerability could enable externally supplied scripts to be executed in the security context of the user administering the MDS Connection Service using the BlackBerry MDS Connection Service administrative web page on port 8080 .
RIM has corrected this vulnerability in BlackBerry Enterprise Server version 4.1.6 MR5, and recommends that this update be installed for improved stability and security.
Visit http://www.blackberry.com/go/serverdownloads to obtain this update for affected BlackBerry Enterprise Server software versions.
The issue can be fully mitigated by disabling script execution within the browser. However, this may affect operation of the features of the BlackBerry MDS Connection Service administrative web page on port 8080. Partial mitigation can be achieved by logging in to the BlackBerry MDS Connection Service administrative web page on port 8080 using an account with lesser rights or from a system with a browser that supports enhanced security mode such as Microsoft® Windows Server 2003, Microsoft Windows Server 2008 or Microsoft Vista .
CVSS is a vendor agnostic, industry open standard designed to convey the severity of vulnerabilities. CVSS scores may be used to determine the urgency for update deployment within an organization. CVSS scores range from 0.0 (no vulnerability) to 10.0 (critical). RIM uses CVSS in vulnerability assessments to present an immutable characterization of security issues. RIM assigns all security relevant issues a non-zero score.
Visit www.blackberry.com/security for more information on BlackBerry security.
RIM thanks Ken Millar of Sensient Technologies Corporation, Michael Thumann of ERNW, and Martin O'Neal and Stephen de Vries of Corsaire for independently reporting this issue to RIM, and working with RIM to protect its customers .
Updates to article formatting. No technical content changed.
The name of a BlackBerry Enterprise Server tool used to administer the BlackBerry MDS Connection Service was incorrectly given. This advisory has been updated to correct the name of the tool to "the BlackBerry MDS Connection Service administrative web page on port 8080."
By downloading, accessing or otherwise using the Knowledge Base documents you agree:
(b) not to copy, distribute, disclose or reproduce, in full or in part any of the documents without the express written consent of RIM.
Visit the BlackBerry Technical Solution Center at www.blackberry.com/btsc.