Research In Motion has acknowledged two vulnerabilities in BlackBerry Enterprise Server, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerabilities exist in the bundled version of LibTIFF, which is used by the BlackBerry Mobile Data System Connection Service and the BlackBerry Messaging Agent.

For more information:
SA48684 (#2)
SA49938 (#2)

The vulnerabilities are reported in the following products:
* BlackBerry Enterprise Server Express versions 5.0.4 and prior for Microsoft Exchange and IBM Lotus Domino
* BlackBerry Enterprise Server versions 5.0.4 and prior for Microsoft Exchange, IBM Lotus Domino, and Novell Groupwise
* BlackBerry Enterprise Server versions 4.1.7 and earlier for MDS Applications

Solution
Update to a fixed version or apply interim security update.
Further details available to Secunia VIM customers

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers