We Suggest reading:

KB04757 - Corrupt TIFF file may cause heap overflow resulting in Denial of Service in the BlackBerry Attachment Service.
KB04756 - Corrupt PNG file may cause heap overflow in the BlackBerry Attachment Service.
KB04791 - Corrupt Word file may cause buffer overflow in the BlackBerry Attachment Service.
KB00115 - Forwarding attachments from the BlackBerry Wireless Handheld.
KB01655 - Transaction error failure at service error appears when attempting to send an email from the BlackBerry smartphone.
KB03265 - Supported attachment formats for the BlackBerry Internet Service.
KB03662 - BlackBerry device users initializing after upgrade from BlackBerry Enterprise Server software version 2.2 to 4.0.
KB04864 - Attachment Service.
KB10172 - Unable to open attachments on the BlackBerry smartphone.
KB10473 - Unable to open attachments on the BlackBerry smartphone.

Corrupt TIFF file may cause heap overflow resulting in Denial of Service in the BlackBerry Attachment Service

Contents [show]

Doc ID: KB04757
Modified Date: 12-09-2008
Document Type: Security_Advisory

Print this page

Products

BlackBerry® Enterprise Server
BlackBerry® Enterprise Server for IBM® Lotus® Domino®
BlackBerry® Enterprise Server for Microsoft® Exchange
BlackBerry® Enterprise Server for Novell® GroupWise®

Environment

BlackBerry® Enterprise Server 4.0 and later
IBM® Lotus® Domino®
Microsoft® Exchange
Novell® GroupWise®
SDR76709
US-CERT Advisory VU#570768

Background

A presentation by FX of Phenoelit has identified an issue in the BlackBerry Enterprise Server that is known to Research In Motion® and has been corrected in current releases of the BlackBerry Enterprise Server. This article is in reference to US-Computer Emergency Readiness Team (US-CERT) Advisory VU#570768.

Advisory posted: 20 January 2006

Note: The technical content of this article was last modified on 07/20/06. The Last Modified date that appears in the top right of the article indicates an update due to a system upgrade that did not affect article content.

Overview

A corrupt Tagged Image File Format (TIFF) file sent to BlackBerry device users may prevent them from viewing attachments.

Impact

BlackBerry device users may not be able to view attachments. There is no impact on any other services (for example, sending and receiving messages, making phone calls, browsing the Internet, and running BlackBerry device applications to access a corporate network).

Problem

A corrupt TIFF file sent to a BlackBerry device user prevents the BlackBerry device user from viewing attachments.

The BlackBerry Attachment Service automatically restarts either immediately or within a specified time period (the default is 25 minutes). The administrator can manually restart the BlackBerry Attachment Service at any time.

Resolution

To resolve this problem, complete the steps below that correspond to your environment.

Microsoft Exchange

For BlackBerry Enterprise Server software version 4.0, install Service Pack 3, then install software version 4.0 Service Pack 3 Hotfix 3.

IBM Lotus Domino

For BlackBerry Enterprise Server software version 4.0, install Service Pack 3, then install software version 4.0 Service Pack 3 Hotfix 4.

Novell GroupWise

Install BlackBerry Enterprise Server software version 4.0 Service Pack 3, then install software version 4.0 Service Pack 3 Hotfix 1.

Note: To obtain the BlackBerry Enterprise Server software, go to the BlackBerry Software Download Information web site.

Workaround

An administrator can exclude TIFF images from being processed by the BlackBerry Attachment Service in the BlackBerry Enterprise Server, or disable the Attachment Service completely.

To exclude TIFF images from being processed by the BlackBerry Attachment Service, complete the following steps:

On the BlackBerry Enterprise Server, clickStart>Programs> BlackBerry Enterprise Server>BlackBerry Enterprise Server Configuration.
Click the Attachment Server tab.
In the Format Extensions field, delete the.tiff and .tif extensions.

Note: The Format Extensions field is an editable field that lists all the extensions that the BlackBerry Attachment Service will open. A colon is used as a delimiter.
Click Apply, then clickOK.
In Microsoft Windows® Administrative Tools, double-clickServices.
Right-click BlackBerry Attachment Service, then click Stop.
Right-click BlackBerry Attachment Service, then click Start.
Close the Services window.

For Microsoft Exchange and Novell GroupWise, follow these additional steps:

In Administrative Tools, double-clickServices.
Right-click BlackBerry Dispatcher, then clickStop.
Right-click BlackBerry Dispatcher, then clickStart.
Close the Services window.

Important: Restarting certain BlackBerry Enterprise Server services will delay message delivery to BlackBerry devices. For more information, see KB-04789.

For IBM Lotus Domino, follow these additional steps:

Open the Lotus Domino Administrator, then click theServer tab.
Click the Status tab, then clickServer Console.
In the Domino Command field, type tell BES quit and pressENTER.
In the Domino Command field, type load BES and pressENTER.
Close the Lotus Domino Administrator.

Even though the .tiff and .tif extensions have been removed from the list of supported file types, the BlackBerry Attachment Service may automatically detect a TIFF file with a renamed extension and attempt to process the file. Administrators may need to disable the image attachment distiller.

To disable the image attachment distiller, complete the following steps:

On the BlackBerry Enterprise Server, clickStart>Programs> BlackBerry Enterprise Server>BlackBerry Enterprise Server Configuration.
On the Attachment Server tab, select Attachment Server from the Configuration Option drop-down list.
In the Distiller Settings section, clear theEnabled check box for Image Attachments.
Click Apply, then clickOK.
In Administrative Tools, double-clickServices.
Right-click BlackBerry Attachment Service, then click Stop.
Right-click BlackBerry Attachment Service, then click Start.
Close the Services window.

For Microsoft Exchange and Novell GroupWise, follow these additional steps:

In Administrative Tools, double-clickServices.
Right-click BlackBerry Dispatcher, then clickStop.
Right-click BlackBerry Dispatcher, then clickStart.
Close the Services window.

For IBM Lotus Domino, follow these additional steps:

Open the Lotus Domino Administrator, then click theServer tab.
Click the Status tab, then clickServer Console.
In the Domino Command field, type tell BES quit and pressENTER.
In the Domino Command field, type load BES and pressENTER.
Close the Lotus Domino Administrator.

Additional Information

Visit www.blackberry.com/security for more information on BlackBerry security.