-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2011.0062
               BlackBerry Enterprise Server vulnerabilities
                              10 August 2011

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              BlackBerry Enterprise Server
Operating System:     Windows
                      Netware
                      Linux variants
                      Solaris
                      AIX
Impact/Access:        Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution:           Patch/Upgrade
CVE Names:            CVE-2011-1167 CVE-2011-0192 CVE-2010-3087
                      CVE-2010-2595 CVE-2010-1205 
Member content until: Friday, September  9 2011
Reference:            ASB-2010.0175
                      ASB-2010.0157.2
                      ESB-2011.0320
                      ESB-2010.0600

OVERVIEW

        Five vulnerabilities have been found and corrected in BlackBerry
        Enterprise Server software. [1]


IMPACT

        The vulnerabilities are in the image processing components of the
        BlackBerry Enterprise Server software. Specifically the TIFF and PNG
        image processing code is vulnerable and could allow a remote attacker
        to execute code without the user needing to click a link, open an
        attachment or even view the malicious email or images. [1]
        
        The attacker could execute code with permissions of the BlackBerry
        Enterprise Server login account. [1]


MITIGATION

        RIM has released updated software to correct these vulnerabilities. [1]


REFERENCES

        [1] Vulnerabilities in BlackBerry Enterprise Server components that
            process images could allow remote code execution
            http://blackberry.com/btsc/KB27244

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBTkISP+4yVqjM2NGpAQJD8BAAtObHqSVkE30piGVej/Yr8JA9uyTcUqHH
15uuyR1fqS8MPOA8Itf8z4N1hk0Fa6Y641dwAOaHFYG7W0wgMJODodyBO4goVCIt
hBtAKngl/T01E2kHjruvhTV6APRVxc4AuzvBtP58OzzxdBoLEf7UH/P94Bb2Fhfb
pBat4WZz5we1xJAkPbsg/YXdE1iLOxKBWvz3kaC3yRQB0sIDCPYmAYEk787U7rPf
AYR3Rhhe2s+AYIjPjmZMBqf89UWkoVkEz09wh2+fq1QWkz3o9KYOsYIalMR2LZqn
5K5YrWLMcRq0D++rdkhRiXdE8IyCbajacjh/bP+DtoYGz+zg9lglruw5TQ+2SgrO
C4cv3ejijonAVjUDXICSdDXa/v/7hdQJn9jk4rSSPStl9cDYUwgDYYUkLg28fvxt
XC2vDyfVpYJENyLvDV0al4kapE6e+oOR2WWAMvbNMRmbqNPeGbFKft+IbYwwIQPJ
oMa5tQNluQoqnsv6x7aHg+VuIlRy5DxRdl6Owcbmj79sLfUYHoAmT0kVpE5/aBKw
6mJ2YfIVGqvudOPS07Upw9I9ahC6/pAHnohTsSkw53XKDUMPmSirsEmUOjszaiAc
FEdbD5boPOEJNFqbWbPSUCwwxDzDxcS+itpwYoAGLclbuCXVBnmV2Vhm+J/VfslM
pQRuiSMHAHo=
=7tAE
-----END PGP SIGNATURE-----