| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 12 Mar 2007 10:39:23 +0000
From: "mike kemp" <clappymonkey@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: RIM BlackBerry Pearl 8100 Browser DoS
RIM BlackBerry Pearl 8100 Browser DoS
------
12 March 2007
Summary:
A vulnerability has been discovered that could impact upon the availability
of the BlackBerry 8100 Wireless handheld (v4.2.0.51). It is possible for a
remote attacker to construct a WML page that contains an overly long string
value within a link (e.g.: <a href = "aaaaaaaaaaaaaaaaaaa etc.>). Should the
page or link be accessed by BlackBerry devices, this leads to a temporary
Denial of Service within the 4thPass browser component on the device, and
temporary device inoperability. Normal functionality will be returned to the
browser / device after an amount of time relative to the size of the link
supplied, or by physically removing and reinserting the battery thereby
creating a reset.
Business Impact:
Exploitation of this issue can lead to a loss of device functionality.
Affected Product(s):
The BlackBerry 8100 (Pearl) handheld device (v4.2.0.51)
Remediation:
Upgrade to vendor patch 4.2.1
Additional details of this vulnerability are available from the vendor at
www.blackberry.com/security/news.jsp
Credit:
Michael Kemp (www.clappymonkey.com)
Content of type "text/html" skipped
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists