BlackBerry’s Security Incident Response Team (BBSIRT) has released a Security Advisory outlining the resolution of a remote code execution vulnerability in BlackBerry 10.
“BlackBerry is committed to protecting customers from potential security risks, and while there are no known attacks targeting customers at this time, we recommend that all BlackBerry 10 smartphone customers apply the latest software update to be protected from this issue,” said Scott Totzke, the senior vice president of security at the company.
According to the advisory note, the exploit of the bug is greatly limited due to the fact that the attacker would need either physical access to the device in question or significant interaction from the host.
In order for the attacker to have successful exploitation, it would require the attacker to send a maliciously crafted message over a Wi-Fi network to what is known as the qconnDoor service. The exploitation of the bug requires that the targeted user is operating the device in development mode.
BBSIRT also notes, an attacker could exploit an unpatched phone by connecting it to a computer and sending the exploit to the qconnDoor service directly.
“A stack-based buffer overflow vulnerability exists in the qconnDoor service supplied with affected versions of BlackBerry 10 OS. The qconnDoor service is used by BlackBerry 10 OS to provide developer access, such as shell and remote debugging capabilities, to the smartphone,” the advisory says.
“Successful exploitation of this vulnerability could potentially result in an attacker terminating the qconnDoor service running on a user’s BlackBerry smartphone. In addition, the attacker could potentially execute code on the user’s BlackBerry smartphone with the privileges of the root user (superuser).”
BlackBerry says they are not aware of any known reported active exploits targeting the bug.
