Click here to receive your FREE subscription to Campus Technology
News
Research in Motion Issues Fix for Blackberry PDF Bug
7/21/2008
|
|
Research in Motion Ltd., maker of the popular BlackBerry handset, on Friday issued a patch to plug a vulnerability in its BlackBerry Enterprise Server (BES) solution. The vulnerability could allow hackers to enter into a network via a maliciously crafted PDF file.
The hotfix was distributed via a cluster of updates to BES systems. It's designed to remedy a bug in the PDF distiller function of BlackBerry's attachment mechanism, which enables users to open up documents from the mobile device.
The exploit enabled a remote code execution attack if the user opened up corrupt Adobe or other PDF-type files.
Research in Motion's advisory proposes that network administrators working within a Windows enterprise environment update to BES Version 4.1, Service Pack 6 for Microsoft's Exchange Server.
Using the new patch is much safer than relying on workarounds, according to one network security expert reacting to the news. For instance, relying on updating the BlackBerry Unite software -- an application that can be loaded onto the handset to detect and clean potentially infected files -- isn't the most optimal solution.
"It looks like they [Research in Motion] may have solved the problem for now by what they did [on Friday] because it's very tricky to sanitize these files on the client side," said Kevin Gillis, vice president of product management for IPswitch, a network monitoring, file transfer and messaging software firm in Lexington, Mass. "It's much better to do it on the server side so that the carrier-class scanner is more effective in this case."
Gillis added that the bigger issue now for companies will be reacting to the downtime that may have been caused by putting a temporary moratorium on sending PDFs via the handset, as some enterprises may have done while awaiting the patch.
"You have people sending presentations, graphs and charts all the time over these phones and while the problem is serious enough to wipe out the devices' whole memory storage, I think this is a reminder of why disaster recovery solutions and best practices are important too," he said.
Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others. You can contact Jabulani at editor@entmag.com.
Cite this Site
copy text (above) for proper citation
Recommended Reading
- Tufts Grants Rights for Mileage-Increasing Transportation Technology to Electric Truck
Tufts University has optioned rights to a technology that can recharge the batteries of any hybrid electric and electric-powered vehicle while it is driven. The Tufts-developed technology could increase by 20 percent to 70 percent the miles per gallon or total driving range performance of vehicles like the Honda Civic, Ford Escape, and Toyota Prius hybrids and the Tesla Motors and Phoenix Motorcars electric vehicles.
- U Florida and Cyntellect Collaborate to Unlock Mysteries of Cancer Stem Cells
The University of Florida has entered into a research agreement with life sciences company Cyntellect. The university's Interdisciplinary Center for Biotechnology Research will work with the company to focus on a variety of research areas including the purification and analysis of cancer stem cells (CSCs), rare cells believed to be directly involved in propagating cancers.
- George Mason U Receives Grant To Deploy Intergraph Apps for Intelligence Curriculum
George Mason University (GMU) in Fairfax, VA has been awarded a grant from Intergraph to enable students enrolled in GMU's Geospatial Intelligence Graduate Certificate program to use the company's geospatial production and exploitation software as part of their core curriculum.
- Institute for Cyber Security at U Texas, San Antonio Opens Incubator
The University of Texas at San Antonio (UTSA) Institute for Cyber Security (ICS) has launched a new Internet security incubator. The incubator was developed to commercialize promising technologies that address major cyber security and privacy issues. The first companies to enter the incubator are Denim Labs and SafeMashups.
- ISO/IEC Publishes Office Open XML Standard
ISO/IEC has published the Office Open XML (OOXML) file format standard, formally known as ISO/IEC 29500:2008. It describes file formats originally designed by Microsoft for its Office 2007 productivity suite, which are used in presentation, spreadsheet and word processing applications.
- Dynamics NAV 2009 ERP Coming Next Month
Microsoft exec Kirill Tatarinov Wednesday described some new features to expect in the forthcoming Microsoft Dynamics NAV 2009 enterprise resource planning solution. He gave the keynote address at Microsoft's Convergence 2008 event in Copenhagen, Denmark.
