BlackBerry 7270 Phone SIP Stack Format String Vulnerability

Bugtraq ID:	24548
Class:	Design Error
CVE:	CVE-2007-3444
Remote:	Yes
Local:	No
Published:	Mar 26 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Sipera VIPER Lab is credited with the discovery of this vulnerability.
Vulnerable:	Rim Blackberry Device Software 4.0.1 .83 Rim BlackBerry 7270 0
Not Vulnerable:	Rim Blackberry Device Software 4.0.1 .108

BlackBerry 7270 Phone SIP Stack Format String Vulnerability

BlackBerry 7270 phone is prone to a remote format-string vulnerability.

An attacker can exploit this issue to cause certain features of the phone to become unusable until the phone has been reset.

BlackBerry 7270 with BlackBerry Device Software 4.0.1.83 and earlier versions are vulnerable.

NOTE: When exploited, the device may generate the following error message:

"Uncaught exception: java.lang.IllegalArgumentException"

BlackBerry 7270 Phone SIP Stack Format String Vulnerability

An attacker must send a malicious SIP INVITE message to a vulnerable phone to exploit this issue.

BlackBerry 7270 Phone SIP Stack Format String Vulnerability

Solution:
The vendor has released a fix that addresses this issue. Please see the referenced advisory for more information.

BlackBerry 7270 Phone SIP Stack Format String Vulnerability

References:

• Vendor Homepage (Research In Motion)
  
• Format string vulnerability in Blackberry�?� 7270 SIP stack implementation may cau (Sipera Systems)
  
• SIP INVITE vulnerability in From field format string on the BlackBerry 7270 smar (BlackBerry)