-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                              ESB-2010.0819.2
               Vulnerability in BlackBerry Desktop Software
                                10 May 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Blackberry Desktop Software
Publisher:         CCIRC
Operating System:  Windows
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2010-2600  

Original Bulletin: 
   http://www.publicsafety.gc.ca/prg/em/ccirc/2010/av10-034-eng.aspx

Revision History:  May       10 2012: Corrected details
                   September 13 2010: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

PUBLIC SAFETY CANADA   
CANADIAN CYBER INCIDENT RESPONSE CENTRE      

*****************      
    ADVISORY    
*****************      

Number: AV10-034   
Date:   10 September 2010
  
********************************************
Vulnerability in BlackBerry Desktop Software 
********************************************

PURPOSE
- ---------
The purpose of this advisory is to raise awareness of a vulnerability in 
Blackberry Desktop Software.


ASSESSMENT
- -------------

There is a critical vulnerability in the Blackberry Desktop Software. The 
vulnerability is caused by the application loading libraries (DLL) in an 
insecure manner, which may allow a malicious user to remotely execute code on 
an affected system. This can be exploited by tricking a user in opening a file 
associated with Blackberry Desktop Software located on a remote WebDAV or SMB 
share. The BlackBerry Desktop Manager needs to be running for a malicious user 
to exploit this vulnerability.

The CVE number for this vulnerability is CVE-2010-2600.

The CVSS base score is 6.5, or Medium.


Affected Products
- -----------------
BlackBerry Desktop Software (all versions) for PC

SUGGESTED ACTION
- ----------------
Research in Motion (RIM) has released a fix for this vulnerability. CCIRC 
recommends that administrators test and deploy these updates at the earliest 
opportunity.

Upgrade to version 6.0.0.47.
https://www.blackberry.com/Downloads/contactFormPreload.do?code=A8BAA56554F96369AB93E4F3BB068C22&dl=A2C0D61EB187AB3AFD247A852FAD3647 

References:
- -----------
http://secunia.com/advisories/41398
http://secunia.com/advisories/41346 
http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB24242 


Note to Readers
- ---------------      

The Canadian Cyber Incident Response Centre (CCIRC) provides a focal point for 
Canada's cyber threat and vulnerability warning, analysis and response. CCIRC 
is responsible for assuring the resilience of national critical infrastructure 
through monitoring threats and coordinating a federal response to cyber 
security incidents of national interest. CCIRC operates in conjunction with the 
Government Operations Centre (GOC) within Public Safety Canada and is a key 
component of the government's all-hazards approach to emergency management and 
national security.
 

For general inquires into the role of Public Safety Canada, please contact the 
department's Public Affairs division at:
Telephone:  613-944-4875 or 1-800-830-3118  
Fax:        613-998-9589  
E-mail:     communications@ps-sp.gc.ca

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT6ssF+4yVqjM2NGpAQIm6hAAnej6y5ez3oYxIpssfRlCzbT8Ps8Bbpj7
u1eLmsf/qoVm+ksSqhnrwL5v8iflQnD/WC0CI55z7UQxQF575Dx9QdJgbJYSl4Yi
XduGX3QIbI4tJtq3yMecEU1IYeake9AD+pcVqa2D9/US1UNujUQN15D/ERDf5OXN
wFlKkXHJwTJhXh0sIQZMJe0wAET0OUQF3bBXgH1WPAiT74IaxWlkkiG7R4NPVS9l
e7LKI/dJKUphQd3LorvCelHZ+ingyi7x+Fu1SF3ureqhu+1rkfZXjLz1GLTYIEVa
Dh0W7vkpwcGEcgg/DD1grb8ENKWVkszl+Eiaw0Sa1WUehF7wysjd//zPASkJ0kza
Gf63vxVSPwwtlEgTNoCGnAgKuMYdrSKwWAj2g+idF05/lm+n3lBCe2mTT7WnH3uV
0uItNvsk+nFzm2Ly+CY99aV1ZuNsR6nnuT+53rePpkrXQxMs5VCx/Vw8V9F3Lvzz
+3sSppdoQm6NKleV22/dErIuzwcWQ3x+tFyynROAe6QKr1SF4CKUlasjTJetY2C/
LA/1lwt1z+zQOGyIkcmUWoh2WdFhm7jFIAfa4J1zVr8KxZgtrk0ss9XMpGrOCAJe
1q8vNRb9wUcQU+8euTxZIqcclKzrBwiCep4Koybmy823yEleHDNzUJ+XxROzW/dJ
5pNp/wtZQr4=
=IYxz
-----END PGP SIGNATURE-----