Research In Motion BlackBerry Device Software Cross Domain Information Disclosure Vulnerability
BID:43685
Info
Research In Motion BlackBerry Device Software Cross Domain Information Disclosure Vulnerability
| Bugtraq ID: | 43685 |
| Class: | Origin Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 04 2010 12:00AM |
| Updated: | Oct 04 2010 12:00AM |
| Credit: | 599eme Man |
| Vulnerable: |
Research In Motion Blackberry Device Software 4.7.1 .57 Research In Motion Blackberry Device Software 4.7.1 Research In Motion Blackberry Device Software 4.7 .179 Research In Motion Blackberry Device Software 4.7 Research In Motion Blackberry Device Software 4.6.1 .309 Research In Motion Blackberry Device Software 4.6.1 Research In Motion Blackberry Device Software 4.6 .303 Research In Motion Blackberry Device Software 4.6 Research In Motion Blackberry Device Software 4.5 .173 Research In Motion Blackberry Device Software 4.5 Research In Motion Blackberry Device Software 4.0.2 Research In Motion Blackberry Device Software 4.0.1 .83 Research In Motion Blackberry Device Software 4.0.1 .108 Research In Motion Blackberry Device Software 4.0 Research In Motion Blackberry Device Software 5.0 Research In Motion Blackberry 8800 4.2 Research In Motion BlackBerry 9700 |
| Not Vulnerable: | |
Discussion
Research In Motion BlackBerry Device Software Cross Domain Information Disclosure Vulnerability
Research In Motion BlackBerry Device Software is prone to a cross-domain information-disclosure vulnerability because the application's web browser fails to properly enforce the same-origin policy.
An attacker can exploit this issue to access local files or content from a browser window in another domain or security zone. This may allow the attacker to obtain sensitive information or may aid in further attacks.
Research In Motion BlackBerry Device Software is prone to a cross-domain information-disclosure vulnerability because the application's web browser fails to properly enforce the same-origin policy.
An attacker can exploit this issue to access local files or content from a browser window in another domain or security zone. This may allow the attacker to obtain sensitive information or may aid in further attacks.
Exploit / POC
Research In Motion BlackBerry Device Software Cross Domain Information Disclosure Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to visit a malicious website.
The following proof-of-concept code is available:
To exploit this issue, an attacker must entice an unsuspecting user to visit a malicious website.
The following proof-of-concept code is available:
Solution / Fix
Research In Motion BlackBerry Device Software Cross Domain Information Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Research In Motion BlackBerry Device Software Cross Domain Information Disclosure Vulnerability
References:
References:
- Research In Motion Homepage (Research In Motion)