#VU42472 Permissions, Privileges, and Access Controls in Blackberry Enterprise Service - CVE-2013-3693

Vulnerability identifier: #VU42472

Vulnerability risk: High

CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2013-3693

CWE-ID: CWE-264

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Blackberry Enterprise Service
Client/Desktop applications / Messaging software

Vendor: BlackBerry

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The BlackBerry Universal Device Service in BlackBerry Enterprise Service (BES) 10.0 through 10.1.2 does not properly restrict access to the JBoss Remote Method Invocation (RMI) interface, which allows remote attackers to upload and execute arbitrary packages via a request to port 1098.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Blackberry Enterprise Service: 10.0 - 10.1.2

---

External links
https://btsc.webapps.blackberry.com/btsc/viewdocument.do;jsessionid=1C7CE6911426BCFAF2A80C3834F4DF0F?externalId=KB35139&sliceId=1&cmd=displayKC&docType=kc&noCount=true&ViewedDocsListHelper=com.kanisa.apps.common.BaseViewedDocsListHelperImpl
https://secunia.com/advisories/55187

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.