This isn’t a ‘sky is falling’ moment by any stretch but, it does affect a very large user population so I thought I would share this one.
From Secunia:
Description:
Sipera VIPER Lab has reported some vulnerabilities in Blackberry, which can be exploited by malicious people to cause a DoS (Denial of Service).1) A format string error in the handling of SIP INVITE messages can be exploited to prevent the BlackBerry smartphone from making a call by sending a specially crafted SIP INVITE message containing a URI with a user name but no host name in the Contact header.
2) An error exists in the processing of SIP INVITE messages can be exploited to prevent the BlackBerry smartphone from clearing the INVITE transaction state properly resulting in the phone being blocked for approximately 40 seconds.
3) An error in the handling of SIP INVITE messages can be exploited to prevent the BlackBerry smartphone from making a call by sending a specially crafted SIP INVITE message.
Successful exploitation of these vulnerabilities requires access to a private branch exchange (PBX) from within an enterprise network.
The vulnerabilities are reported in the BlackBerry Device Software 4.0 Service Pack 1 Bundle 83 and earlier on a BlackBerry 7270 smartphone. Reportedly this does not affect any other BlackBerry device.
Solution:
Update to BlackBerry Device Software 4.0 Service Pack 1 Bundle 108 or later.
[tags]Blackberry, Blackberry Vulnerabilities, RIM[/tags]
