BlackBerry Link Remote File Access Feature Privilege Escalation Vulnerability
BID:63695
Info
BlackBerry Link Remote File Access Feature Privilege Escalation Vulnerability
| Bugtraq ID: | 63695 |
| Class: | Design Error |
| CVE: |
CVE-2013-3694 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 12 2013 12:00AM |
| Updated: | Nov 12 2013 12:00AM |
| Credit: | Tavis Ormandy and Ollie Whitehouse |
| Vulnerable: |
BlackBerry Link for Mac OS 1.1.1 (build 35) BlackBerry Link for Mac OS 1.0.1 (build 6) BlackBerry Link for Windows 1.2.0.28 BlackBerry Link for Windows 1.0.1.12 |
| Not Vulnerable: |
BlackBerry Link for Windows 1.2.1.31 BlackBerry Link for Mac OS 1.1.1 (build 39) |
Discussion
BlackBerry Link Remote File Access Feature Privilege Escalation Vulnerability
BlackBerry Link is prone to a remote privilege-escalation vulnerability.
An attacker can exploit this issue to execute arbitrary code with elevated privileges within the context of user running the affected application.
BlackBerry Link is prone to a remote privilege-escalation vulnerability.
An attacker can exploit this issue to execute arbitrary code with elevated privileges within the context of user running the affected application.
Exploit / POC
BlackBerry Link Remote File Access Feature Privilege Escalation Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim to follow a malicious URI or visit a malicious website.
To exploit this issue, an attacker must entice an unsuspecting victim to follow a malicious URI or visit a malicious website.
Solution / Fix
BlackBerry Link Remote File Access Feature Privilege Escalation Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
BlackBerry Link Remote File Access Feature Privilege Escalation Vulnerability
References:
References:
- BlackBerry Link Homepage (BlackBerry )
- BlackBerry Link WebDAV Service File Upload Remote Code Execution (Tavis Ormandy)
- BSRT 2013-012 Vulnerability in remote file access feature impacts BlackBerry Lin (BlackBerry )