CVE-2009-0176: Buffer Overflow
First published: Tue Jan 20 2009(Updated: )
Multiple heap-based buffer overflows in the PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6, BlackBerry Professional Software 4.1.4, and BlackBerry Unite! before 1.0.3 bundle 28 allow user-assisted remote attackers to execute arbitrary code via (1) a crafted stream in a .pdf file, related to "symWidths"; or (2) a crafted data stream in a .pdf file, related to "bitmaps."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| BlackBerry Enterprise Server | =4.1.3 | |
| BlackBerry Unite | =1.0 | |
| BlackBerry Unite | =1.0.2 | |
| BlackBerry Unite | <=1.0.3 | |
| BlackBerry Unite | =1.0.1 | |
| BlackBerry Enterprise Server | =4.1.4 | |
| BlackBerry Enterprise Server | =4.1.6 | |
| BlackBerry Enterprise Server | =4.1.5 | |
| Blackberry Professional Software | =4.1.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB17118
- http://www.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB17119
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=765
- http://www.securityfocus.com/bid/33224
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=764
- http://secunia.com/advisories/33534
Frequently Asked Questions
What is the severity of CVE-2009-0176?
CVE-2009-0176 is classified as a high-severity vulnerability due to the potential for remote code execution.
What versions are affected by CVE-2009-0176?
CVE-2009-0176 affects BlackBerry Enterprise Server versions 4.1.3 to 4.1.6, BlackBerry Professional Software 4.1.4, and various versions of BlackBerry Unite up to 1.0.3.
How do I fix CVE-2009-0176?
To mitigate CVE-2009-0176, update your BlackBerry Enterprise Server, Professional Software, or BlackBerry Unite to the latest patched versions.
Can CVE-2009-0176 be exploited remotely?
Yes, CVE-2009-0176 can be exploited by remote attackers if users are tricked into opening malicious PDF files.
What is the nature of the vulnerability in CVE-2009-0176?
CVE-2009-0176 involves multiple heap-based buffer overflows in the PDF distiller component of the affected software.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/research in motion limited
- canonical/blackberry enterprise server
- version/blackberry enterprise server/4.1.3
- canonical/blackberry unite
- version/blackberry unite/1.0
- version/blackberry unite/1.0.2
- version/blackberry unite/1.0.3
- version/blackberry unite/1.0.1
- version/blackberry enterprise server/4.1.4
- version/blackberry enterprise server/4.1.6
- version/blackberry enterprise server/4.1.5
- canonical/blackberry professional software
- version/blackberry professional software/4.1.4