Research in Motion (RIM) BlackBerry Handheld web browser does not properly handle Java Application Description (JAD) files

Overview

The Research in Motion (RIM) BlackBerry Handheld web browser is vulnerable to a denial of service via a specially crafted Java Application Description (JAD) file.

Description

The BlackBerry Handheld web browser does not properly handle malformed JAD files. JAD files in J2ME are used to describe Java applications (icons, size, description, vendor, platform requirements, etc) to the BlackBerry Handheld. From RIM Technical Knowledge Center article KB-04755:

If the JAD file is formatted to contain a long application name and vendor string (i.e., 256 or more characters) to your BlackBerry device, the browser appears to stop responding.
…
A browser dialog is not properly dismissed. The browser displays the application name or vendor string on the download screen (this appears as several lines). The long application name indicates that there may be problems with the JAD file and caution should be exercised when downloading the application.

---

Impact

By convincing a user to access a specially crafted JAD file, an unauthenticated, remote attacker could cause the browser to hang.

---

Solution

Upgrade

According to RIM Technical Knowledge Center article KB-04755: “Install BlackBerry Device Software 4.0.2 or later. To obtain the most recent version of the device software, contact your service provider.”

---

Bypass browser dialog

To bypass the browser dialog, start a new browser application, or click on a URL from an email message.

Reset BlackBerry Handheld device

If necessary, reset the BlackBerry Handheld by removing and re-inserting the battery.

---

Vendor Information

829400

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Research in Motion (RIM) __ Affected

Updated: December 31, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see RIM Technical Knowledge Center article KB-04755.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23829400 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://events.ccc.de/congress/2005/fahrplan/events/596.en.html&gt;
• <http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/7925/8142/?nodeid=1167791&gt;
• http://www.blackberry.com/knowledgecenterpublic/livelink.exe/?func=doc.Fetch&nodeId=739746

Acknowledgements

This vulnerability was reported by FX of Phenoelit. Thanks to RIM for information used in this document.

This document was written by Art Manion.

Other Information

CVE IDs:	CVE-2005-2343
Severity Metric:	2.46 Date Public: