Announcement Announcement Module
Collapse
No announcement yet.
Buffer Overflow Vulnerability in BlackBerry Z 10 'qconnDoor' Service Page Title Module
Move Remove Collapse
X
Conversation Detail Module
Collapse
  • Filter
  • Time
  • Show
Clear All
new posts

  • Buffer Overflow Vulnerability in BlackBerry Z 10 'qconnDoor' Service

    Buffer Overflow Vulnerability in BlackBerry Z 10 'qconnDoor' Service


    Severity Rating: High

    System Affected:
    • BlackBerry Z 10 with software 10.1.0.2312,OS version 10.1.0.2354

    Overview
    A Stack-based buffer-overflow vulnerability has been reported in BlackBerry Z 10 OS version 10.1.0.2354 which could allow a remote attacker to execute arbitrary code via a crafted packet in a TCP session on a wireless network.

    Description
    qconndoor is a network service, available for Blackberry Z10 to allow developers to access the device using BlackBerry's SDK tool-chain. The service is intended for being used by software
    developers in the Blackberry developer-mode only,but it still runs, even if the developer-mode is not enabled. The qconndoor process is executed with root privileges.

    The vulnerability exists due to stack-based buffer overflow in the qconnDoor service that can be triggered by an unauthenticated remote attacker when the developer-mode has been previously enabled. A remote attacker can exploit this vulnerability to execute arbitrary code via a crafted packet with any command code that triggers AES-decryption of the data payload.

    Solution
    Apply appropriate patch as mentioned in BlackBerry Bulletin
    http://www.blackberry.com/btsc/KB35816

    Vendor Information
    BlackBerry
    http://www.blackberry.com/btsc/KB35816

    References
    BlackBerry
    http://www.blackberry.com/btsc/KB35816

    Neohapsis
    http://archives.neohapsis.com/archiv...4-04/0036.html

    Security Focus
    http://www.securityfocus.com/bid/66713/info

    ModZero
    http://www.modzero.ch/advisories/MZ-...-qconnDoor.txt
Tag Cloud Tag Cloud Module
Collapse
Working...
X