Research in Motion (RIM) BlackBerry Router vulnerable to denial of service via Server Routing Protocol (SRP)

Overview

The Research in Motion (RIM) BlackBerry Router contains a vulnerability in the way the router handles Server Routing Protocol (SRP) packets. By sending specially crafted SRP packets to the router, an attacker could cause a denial of service.

Description

The BlackBerry Router is a component of the BlackBerry Enterprise Server (BES). The BlackBerry Router manages connections and routes data between between BES servers, BlackBerry Infrastructure, BlackBerry Handhelds, and other BlackBerry client devices. A vulnerability in the way the BlackBerry Router could allow an attacker using specially crafted SRP packets to cause a denial of service. If the router stops functioning, BlackBerry communication will be disrupted.

The BlackBerry Router uses SRP to make an outbound connection to the BlackBerry Infrastructure on port 3101/tcp. In order to exploit this vulnerability, a remote attacker would need to subvert DNS or otherwise impersonate the BlackBerry Infrastructure or intercept the TCP connection. An attacker with access to the network containing the BlackBerry Router may be able to initiate TCP connections to the router to exploit the vulnerability.

---

Impact

By establishing a TCP connection with a BlackBerry Router, an unauthenticated, remote attacker could cause a denial of service, disrupting communication between BES components and BlackBerry Handheld devices.

---

Solution

RIM Technical Knowledge Center article KB-04758 states that “This is a previously reported issue that has been escalated internally to our development team. No resolution time frame is currently available.”

---

Deploy BlackBerry Routers and BES servers according to best practices, including restricting access to BlackBerry components using firewalls. Static DNS entries for BlackBerry Infrastructure hosts can help mitigate the risks of an attacker subverting DNS to impersonate the BlackBerry Infrastructure. Please see RIM Technical Knowledge Center article KB-04758 for further information.

---

Vendor Information

392920

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Research in Motion (RIM) __ Affected

Updated: December 30, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

Please see RIM Technical Knowledge Center article KB-04758.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23392920 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://events.ccc.de/congress/2005/fahrplan/events/596.en.html&gt;
• <http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/728075/728850/728215/?nodeid=1167898&gt;
• http://www.blackberry.com/knowledgecenterpublic/livelink.exe/?func=doc.Fetch&nodeId=739746
• http://www.blackberry.com/knowledgecenterpublic/livelink.exe/?func=doc.Fetch&nodeId=817014

Acknowledgements

This vulnerability was reported by FX of Phenoelit. Thanks to RIM for information used in this document.

This document was written by Art Manion.

Other Information

CVE IDs:	CVE-2005-2342
Severity Metric:	5.41 Date Public: