full-disclosure - [TEHTRI-Security] Quick BlackBerry Security Check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4D8266C8.1080800@tehtri-security.com>
Date: Thu, 17 Mar 2011 20:53:44 +0100
From: Laurent OUDOT at TEHTRI-Security <laurent.oudot-ml@...tri-security.com>
To: full-disclosure@...ts.grok.org.uk, 
	Laurent OUDOT at TEHTRI-Security <laurent.oudot-ml@...tri-security.com>
Subject: [TEHTRI-Security] Quick BlackBerry Security Check


Gents,

If you are a lucky BlackBerry owner, or an administrator of many BB
devices, you can do a quick security check of your smartphone(s), by
browsing this web page from your device (free quick check):

    http://tehtris.com/bbcheck

For now, this will check for you if you are potentially vulnerable
against those exploits:

-> Nov 2007 - US-CERT Advisory VU#282856 - Exploit from Michael Kemp
   http://www.blackberry.com/btsc/KB12577

-> Jan 2011 - CVE-2010-2599 - Exploit found by TEHTRI-Security
   http://www.blackberry.com/btsc/KB24841

-> Mar 2011 - CVE-2011-1290 - Awesome Pwn2own/CSW exploit from Vincenzo
Iozzo, Ralf Philipp Weinmann, and Willem Pinckaers

A workaround for this latest vulnerability (CVE-2011-1290) could be to
disable JavaScript, as explained on RIM resources.

You should definitely read this: http://www.blackberry.com/btsc/KB26132

Have a nice day,

Laurent OUDOT, CEO TEHTRI-Security -- "This is not a game"
 http://www.tehtri-security.com/
 Follow us: @tehtris

=> Join us for more hacking tricks during next awesome events:

- SyScan Singapore (April) -- Training: "Advanced PHP Hacking"
http://www.syscan.org/index.php/sg/training

- HITB Amsterdam (May) -- Training: "Hunting Web Attackers"
http://conference.hackinthebox.org/hitbsecconf2011ams/?page_id=16

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/