Multiple vulnerabilities have been reported in BlackBerry Enterprise Server, which can be exploited by malicious people to conduct cross-site scripting attacks, disclose sensitive information, manipulate certain data, and cause a DoS (Denial of Service).

1) Input passed via the "displayErrorMessage" parameter to webdesktop/app (when "page" is set to "pages/advanced/ManageDevices" and "service" is set to "page") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Some vulnerabilities exist in the bundled Apache Tomcat server.

For more information:
SA44166

Please see the vendor's advisories for a list of affected products.

Solution
Apply the Interim Security Software Update (please see the vendor's advisory for details).

Provided and/or discovered by
1) Ivan Huertas, Cybsec.
2) Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Research In Motion:
http://www.blackberry.com/btsc/KB25966
http://www.blackberry.com/btsc/KB26296

Cybsec:
http://www.cybsec.com/vuln/CYBSEC_Advisory_2011_0401_Cross_Site_Scripting_XSS_in_Blackberry_WebDesktop.pdf

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers