-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                          ESB-2006.0026 -- [Win]
       RIM BlackBerry Enterprise Server Attachment Service does not
                      properly handle PNG image files
                              11 January 2006

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           BlackBerry Enterprise Server (BES)
Publisher:         US-CERT
Operating System:  Windows
Impact:            Execute Arbitrary Code/Commands
                   Denial of Service
Access:            Remote/Unauthenticated
CVE Names:         CVE-2005-2344

Original Bulletin: http://www.kb.cert.org/vuls/id/646976

- --------------------------BEGIN INCLUDED TEXT--------------------

US-CERT Vulnerability Note VU#646976

RIM BlackBerry Enterprise Server Attachment Service does not properly
handle PNG image files

Overview

   The Research in Motion (RIM) BlackBerry Attachment Service contains
   a vulnerability in the way the service handles PNG files. By causing
   the service to render a specially crafted PNG file and convincing a
   user to view the file on a BlackBerry Handheld device, an attacker
   could execute arbitrary code or cause a denial of service to the
   Attachment Service.

I. Description

   The BlackBerry Attachment Service is a component of the BlackBerry
   Enterprise Server (BES). The BlackBerry Attachment Service renders
   certain types of files sent as email attachments for display on
   BlackBerry Handhelds and other BlackBerry client devices. A
   vulnerability in the way the service renders Portable Network Graphic
   (PNG) format image files could allow an attacker supplying a specially
   crafted PNG file to execute arbitrary code or cause the service to
   stop functioning. A user must view the attacker-supplied attachment
   on a BlackBerry Handheld in order to trigger the vulnerability.

   The underlying vulnerability may be related to the way PNG uses zlib.

II. Impact

   By supplying a specially crafted PNG image as an email attachment and
   convincing a user to view the image on a BlackBerry Handheld, a remote,
   unauthenticated attacker could execute arbitrary code or cause a
   denial of service to the Blackberry Attachment Service. The attacker
   may be able to take control of a vulnerable system.

   A denial of service may only affect some users, and the Attachment
   Service may start new threads immediately or after a specified time
   period (25 minutes by default).

III. Solution

Upgrade

   From RIM Technical Knowledge Center article KB-04756:

      For Microsoft Exchange

      Install BlackBerry Enterprise Server 4.0 Service Pack 3, then
      install version 4.0 Service Pack 3, Hotfix 1.

      For IBM Lotus Domino and Novell GroupWise

      Install BlackBerry Enterprise Server 4.0 Service Pack 3.

      To obtain the BlackBerry Enterprise Server software, go to 
      http://www.blackberry.com/Downloads

Disable PNG processing, image attachment distiller, and/or Attachment Service

   As described in RIM Technical Knowledge Center article KB-04756, "An
   administrator can exclude PNG images from being processed by the
   Attachment Service in the BlackBerry Enterprise Server, or disable
   the Attachment Service completely."

Systems Affected

   Vendor	                Status	    Date Updated
   Research in Motion (RIM) Vulnerable  9-Jan-2006

References

   http://events.ccc.de/congress/2005/fahrplan/events/596.en.html
   http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/728075/728850/728215/?nodeid=1167794

Credit

   This vulnerability was reported by FX of Phenoelit. Thanks to RIM for
   information used in this document.

   This document was written by Art Manion.

Other Information

   Date Public	12/27/2005
   Date First Published	01/09/2006 03:58:52 PM
   Date Last Updated	01/09/2006
   CERT Advisory	 
   CVE Name	CVE-2005-2344
   Metric	17.55
   Document Revision	22


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQ8SmVSh9+71yA2DNAQLyggP+JkDazFaSFJUGOhSWQWuXXYKVN4d855el
fCooxHXhyT6sIxIA8Cz0wDZ5Z3BEofx4eYEs0NhoQsBso4Q76TPljhTi4HpARJ49
+2OFlSujUa8EFrgpPF4kTcqKZYCZenaYDhy6dYmwm7buzm/PFW+6t/qmV8oqPsRv
qyyzwyRkZ0Q=
=FXo8
-----END PGP SIGNATURE-----