RCE in Blackberry Enterprise Server
CVE-2008-3246
Unspecified vulnerability in the PDF distiller component in the BlackBerry Attachment Service in BlackBerry Unite! 1.0 SP1 (1.0.1) before bundle 36 and BlackBerry Enterprise Server 4.1 SP3 (4.1.3) through 4.1 SP5 (4.1.5) allows user-assisted remote attackers to execute arbitrary code via a crafted PDF file attachment.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.069 (93.4th percentile) — read the EPSS interpretation.
Affected products
- Blackberry Enterprise_server — versions 4.1, 4.1.3, 4.1.4
- Blackberry Unite — versions 1.0, 1.0.1
- Rim Blackberry_enterprise_server — versions 4.1.3, 4.1.4, 4.1.5
- Rim Blackberry_enterprise_server_for_domino
- Rim Blackberry_enterprise_server_for_exchange
- Rim Blackberry_enterprise_server_for_novell_groupwise
- Rim Blackberry_unite — versions 1.0, 1.0.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_VUPEN)
- cve@mitre.org (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2008-3246?
- CVE-2008-3246 is a vulnerability in Blackberry Enterprise Server, classified under Code Injection. Published 2008-07-21.
- Is CVE-2008-3246 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.