FX has been reported a vulnerability in BlackBerry Enterprise Server, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a vulnerable system.

The vulnerability is caused due to an unspecified error in the BlackBerry Attachment Service when rendering malformed PNG image attachments. This can be exploited to cause a heap-based buffer overflow, which can cause BlackBerry users to be unable to view file attachments and may allow arbitrary code execution on the server.

Successful exploitation requires that the user views a malicious PNG attachment on a BlackBerry Handheld.

The vulnerability has been reported in version 4.0 through version 4.0 Service Pack 2.

Solution
Apply BlackBerry Enterprise Server 4.0 Service Pack 3.
Further details available to Secunia VIM customers

Provided and/or discovered by
FX, Phenoelit.

Original Advisory
http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/728075/728850/728215/?nodeid=1167794

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers