RIM closes critical hole in BlackBerry Enterprise Server

Research In Motion (RIM) has released security updates to close several critical security holes in the BlackBerry Enterprise Server. Once again, the processing of specially crafted PDF attachments potentially allows attackers to gain control of a BlackBerry server. BlackBerry Enterprise Server 5.0.0, 4.1 3 to 4.1.7 as well as BlackBerry Professional Software 4.1 Service Pack 4 are affected.

As with most of the critical holes in BlackBerry products so far, the flaw is contained in the PDF distiller of the server's attachment service, which prepares PDF documents in emails for display on BlackBerry devices. The flaws are only triggered once a user opens the document.

As a workaround, the vendor suggests that users disable the processing of PDF files in the Enterprise Server.

See also:

• Vulnerabilities in the PDF distiller of the BlackBerry Attachment Service for the BlackBerry Enterprise Server, security advisory from RIM.

(crve)