Call it a case of dueling, nuanced, advisories. Research in Motion has challenged a risk advisory from security firm HexView that it put out this week about RIM’s popular Blackberry handheld device, which prompted a new advisory from HexView.
The HexView advisory on Tuesday claimed that the RIM Blackberry could potentially suffer data loss and be at risk of a denial of service attack
“The Blackberry reboots when it tries to notify the user,” HexView’s original advisory said. “No user action is required. It is possible to render Blackberry device completely useless by queuing a number of such messages into user’s mailbox.”
RIM took a look and then followed up with its own advisory.
RIM’s analysis said any buffer overflow, stack corruption, data loss and malicious code penetration risk claimed in the HexView advisory are incorrect. “As of this time, Research In Motion has not received any customer reports of this issue being exploited in practice.”
RIM did concede that part of HexView’s advisory was correct, but that the bug only affects version 3.7 of its software and has already been corrected in BlackBerry handheld software version 3.8 and later.
It was enough, however, for HexView to issue an advisory on its advisory. “There is no buffer overflow condition. Device reset is triggered by a watchdog timer that times out when a long message is being stored in flash memory,” HexView said in its update, which changed the security advisory from “high” to “medium” in the process.
In its advisory, RIM continued, “HexView points out the issue can be created by sending a Microsoft Outlook meeting request message with a large string, over 128KB, in the Location field. It is important to note that Microsoft Outlook limits the size of the Location field to 255 characters, or bytes, so a large Location field cannot be normally or inadvertently created,” RIM stated in its analysis.” Still, RIM also said it replicated the issue defined by HexView on handhelds running handheld software version 3.7 Service Pack 1 software and confirmed a handheld reset can occur.
“The short answer is that there was a bug that could cause the device to reset, but it was fixed previously and there weren’t any reported problems with customers and there weren’t any security issues.” RIM spokesperson Lauren Doherty told internetnews.com.
