BlackBerry Device Software Browser Dialog Box Certificate Mismatch Weakness

Bugtraq ID:	36528
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 28 2009 12:00AM
Updated:	Oct 01 2009 04:20PM
Credit:	Mobile Security Lab and CESG
Vulnerable:	Research In Motion Blackberry Device Software 4.7.1 Research In Motion Blackberry Device Software 4.7 Research In Motion Blackberry Device Software 4.6.1 Research In Motion Blackberry Device Software 4.6 Research In Motion Blackberry Device Software 4.5
Not Vulnerable:	Research In Motion Blackberry Device Software 4.7.1 .57 Research In Motion Blackberry Device Software 4.7 .179 Research In Motion Blackberry Device Software 4.6.1 .309 Research In Motion Blackberry Device Software 4.6 .303 Research In Motion Blackberry Device Software 4.5 .173

BlackBerry Device Software Browser Dialog Box Certificate Mismatch Weakness

The BlackBerry Device Software browser is prone to a weakness that may cause affected users to trust malicious sites.

This issue may potentially lead to other attacks, because users may operate under a false sense of security.

This issue affects all versions prior to BlackBerry Device Software 4.5.0.173, 4.6.0.303, 4.6.1.309, 4.7.0.179, and 4.7.1.57.

NOTE: This issue affects all built-in browsers installed on BlackBerry devices:

BlackBerry Browser
Internet Browser
WAP Browser
Wi-Fi (Hotspot) Browser

BlackBerry Device Software Browser Dialog Box Certificate Mismatch Weakness

An attacker can exploit this issue by enticing a victim to follow a link to a malicious site.

BlackBerry Device Software Browser Dialog Box Certificate Mismatch Weakness

Solution:
Vendor updates are available. Please see the references for details.

BlackBerry Device Software Browser Dialog Box Certificate Mismatch Weakness

References:

• Research In Motion Homepage (Research In Motion)
  
• KB19552 BlackBerry Browser dialog box (Research In Motion)