Corrupt Word file may cause buffer overflow in the BlackBerry Attachment Service

Article ID: KB04791

Type:   Security Advisory

First Published: 12-09-08

Last Modified: 09-02-2010

 

Product(s) Affected:

  • BlackBerry Enterprise Server for Novell GroupWise
  • BlackBerry Enterprise Server for Microsoft Exchange
  • BlackBerry Enterprise Server for IBM Domino
Collapse Products
ExpandAffected Software
  • BlackBerry® Enterprise Server software version 2.2 and later for IBM® Lotus® Domino®
  • BlackBerry Enterprise Server software version 3.6 and later for Microsoft® Exchange
  • BlackBerry Enterprise Server software version 4.0 and later for Novell® GroupWise®
ExpandAre BlackBerry smartphones and the BlackBerry Device Software affected?
No.
CollapseIssue Severity

Not assigned.

CollapseOverview
An internal analysis identified an issue in the BlackBerry Enterprise Server that is known to Research In Motion (RIM) and has been corrected in subsequent software releases.
ExpandRecommendation
Complete the resolution actions documented in this advisory.
CollapseProblem

An internal analysis identified an issue in the BlackBerry Enterprise Server that is known to Research In Motion (RIM) and has been corrected in current or upcoming software releases.

A corrupt Microsoft Word (.doc) file opened on a BlackBerry device could potentially provide a means to execute arbitrary code on the BlackBerry Attachment Service component of the BlackBerry Enterprise Server.

CollapseResolution

Depending on your environment and the BlackBerry Enterprise Server version, install the appropriate software upgrades.

Microsoft Exchange

  • For BlackBerry Enterprise Server software version 3.6, install Service Pack 7.
  • For BlackBerry Enterprise Server software version 4.0, install Service Pack 3, then install BlackBerry Enterprise Server software version 4.0 Service Pack 3 Hotfix 3.

IBM Lotus Domino

  • For BlackBerry Enterprise Server software version 2.2, a resolution for this issue has been developed and is currently undergoing testing. A software upgrade will be made available as soon as testing is complete.
  • For BlackBerry Enterprise Server software version 4.0, install Service Pack 3, then install BlackBerry Enterprise Server software version 4.0 Service Pack 3 Hotfix 4.

Novell GroupWise

  • Install BlackBerry Enterprise Server software version 4.0 Service Pack 3, then install BlackBerry Enterprise Server software version 4.0 Service Pack 3 Hotfix 1.

To obtain the BlackBerry Enterprise Server software, go to the BlackBerry Software Download Information web site.

CollapseWorkaround

A system administrator can exclude Microsoft Word files from being processed by the BlackBerry Attachment Service in the BlackBerry Enterprise Server, or disable the BlackBerry Attachment Service completely.

To exclude Microsoft Word files from being processed by the BlackBerry Attachment Service, complete the following steps:

  1. On the computer, click Start > Programs > BlackBerry Enterprise Server > BlackBerry Enterprise Server Configuration.
  2. Click the Attachment Server tab.
  3. In the Format Extensions field, delete the .doc extension.

    Note: Format Extensions is an editable field that lists all the extensions that the BlackBerry Attachment Service will open. A colon is used as a delimiter.

  4. Click Apply, then click OK.

Even though the .doc extension has been removed from the list of supported file types, the BlackBerry Attachment Service may automatically detect a .doc file with a renamed extension and attempt to process the file. System administrators may need to disable the BlackBerry Attachment Service.

To disable the BlackBerry Attachment Service, complete the following steps:

  1. In Microsoft Windows® Administrative Tools, double-click Services.
  2. Right-click BlackBerry Attachment Service, then click Stop.
  3. Right-click BlackBerry Attachment Service, then click Properties.
  4. From the Startup type drop-down list, select Manual.
  5. Click Apply, then click OK.
CollapseAdditional Information

BlackBerry Security

Visit www.blackberry.com/security for more information on BlackBerry security.

CollapseChange Log

09-02-10

Updates to article formatting. No technical content changed.

02-09-06

Update due to a system upgrade that did not affect article content.

Disclaimer

By downloading, accessing or otherwise using the Knowledge Base documents you agree:

   (a) that the terms of use for the documents found at www.blackberry.com/legal/knowledgebase apply to your use or reference to these documents; and

   (b) not to copy, distribute, disclose or reproduce, in full or in part any of the documents without the express written consent of RIM.


Visit the BlackBerry Technical Solution Center at www.blackberry.com/btsc.