BlackBerry browser dialog box does not clearly indicate mismatches between web site domain names and associated certificates
| Document ID: | KB19552 |
| Modified Date: | 12-21-2009 |
| Document Type: | Security_Advisory |
  Print this page | |
Products
- BlackBerry® Devices
Environment
Research In Motion (RIM) has tested the following software to determine which versions or editions are affected by the issue described in this advisory. Other versions or editions are either past their support life cycle or are not affected.
Affected Software
|
Software |
Component or Functionality |
Severity Rating |
|
|
|
6.8 |
Non-Affected Software
-
BlackBerry Device Software version 5.0.0 and later
-
BlackBerry® Desktop Software
-
Change log
|
Date |
Description of change |
| 12/21/09 | Article updated to clarify which versions of the BlackBerry Device Software are affected by the issue. |
|
|
|
Overview
This advisory relates to a BlackBerry browser dialog box that provides information about web site domain names and their associated certificates. The BlackBerry browser dialog box informs the BlackBerry device user when there is a mismatch between the site domain name and the domain name indicated in the associated certificate, but does not properly illustrate that the mismatch is due to the presence of some hidden characters (for example, null characters) in the site domain name.
Note: This issue affects all built-in browsers on affected BlackBerry devices (BlackBerry Browser, Internet Browser, WAP Browser, and Wi-Fi (Hotspot) Browser).
Issue Severity: This vulnerability has a Common Vulnerability Scoring System (CVSS) score of 6.8.
Issue Status: Vulnerability confirmed. Check for software containing the security update based on your wireless service provider. For more information, see the Resolution section.Recommendation: Complete the resolution actions documented in this advisory.
Mitigation: RIM recommends that BlackBerry device users exercise caution when clicking on links that they receive in email or SMS messages. If a user visits a site that causes a BlackBerry browser dialog box to warn the user about continuing the connection, the user should select Close connection.
RIM thanks both Mobile Security Lab and CESG for separately reporting this issue to RIM, and working with RIM to protect its customers.
Acknowledgements
Impact
A malicious user may be able to deceive a BlackBerry device user into connecting to a web site that is controlled by the malicious user.
Problem
A malicious user could create a web site that includes a certificate that is purposely altered using null (hidden) characters in the certificate's Common Name (CN) field or otherwise manipulated to deceive a BlackBerry device user into believing they have connected to a trusted web site.
If the malicious user then performs a phishing-style attack by sending the BlackBerry device user a link to the web site in an SMS or email message that appears to be from a trusted source, and the BlackBerry device user chooses to access that site, the BlackBerry browser will correctly detect the mismatch between the certificate and the domain name and display a dialog box that prompts the user to close the connection. However, the dialog box does not display null characters, so the user may believe they are connecting to a trusted site and disregard the recommended action to close the connection.
The following screenshot shows an example of a BlackBerry browser dialog box that does not clearly indicate that there is a mismatch between the web server address and its associated certificate
:
Resolution
RIM has issued a software update that resolves this issue in BlackBerry Device Software version 4.5 and later. Versions earlier than 4.5 are unsupported, and versions 5.0.0 and later are unaffected.
To check for available updates for your BlackBerry Update to the BlackBerry Device Software applications version for your BlackBerry device model as indicated in the table below to resolve this issue. If the updated applications version indicated is not available, contact your wireless service provider (carrier).
The updated BlackBerry Device Software is designed to depict null (hidden) characters in the BlackBerry browser dialog box that appears when the user visits a web site with a certificate that does not match the site domain name. In the updated BlackBerry Device Software, the BlackBerry device represents previously hidden null characters with a block, and highlights the non-matching portion of the domain name in bold.
The following screenshot shows an example of a BlackBerry browser dialog box that represents a previously hidden null character with a block and highlights (in bold) the non-matching portion of the domain name:
RIM recommends that BlackBerry device users exercise caution when clicking on links that they receive in email or SMS messages. If a user visits a site that causes a BlackBerry browser dialog box to warn the user about continuing the connection, the user should select Close connection.
Additional Information
CVSS is a vendor agnostic, industry open standard designed to convey the severity of vulnerabilities. CVSS scores may be used to determine the urgency for update deployment within an organization. CVSS scores range from 0.0 (no vulnerability) to 10.0 (critical). RIM uses CVSS in vulnerability assessments to present an immutable characterization of security issues. RIM assigns all security relevant issues a non-zero score.
Visit www.blackberry.com/security for more information on BlackBerry security.
Top of pageDisclaimer
By downloading, accessing or otherwise using the Knowledge Base documents you agree:
(a) that the terms of use for the documents found at http://www.blackberry.com/support/knowledgebase/disclaimer.shtml apply to your use or reference to these documents; and
(b) not to copy, distribute, disclose or reproduce, in full or in part any of the documents without the express written consent of RIM.
Visit the BlackBerry Technical Solution Center at http://www.blackberry.com/btsc.