-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 UPDATE: RIM Blackberry DoS, data loss Original disclosure is available at http://www.hexview.com/docs/20041012-1.txt Classification: =============== Level: low-[MED]-high-crit ID: HEXVIEW*2004*10*14*1 URL: http://www.hexview.com/docs/20041014-1.txt Update summary: =============== Vulnerability level changed to MEDIUM. Vulnerability description is updated. Vendor status is updated. HexView disclosure policy is updated. Vulnerability update: ===================== There is no buffer overflow condition. Device reset is triggered by a watchdog timer that times out when a long message is being stored in flash memory. Since reset is triggered in the middle of write process, it may cause unpredictable results, but in most cases the data does not get corrupted. HexView confirms that there was a data corruption issue during tests, but it was not possible to reproduce it. Vendor Status: ============== Vendor has produced a fix for the vulnerability. About HexView: ============== HexView contributes to online security-related lists for almost a decade. The scope of our expertize spreads over Windows, Linux, Sun, MacOS platforms, network applications, and embedded devices. The chances are you read our advisories or disclosures. For more information visit http://www.hexview.com Distribution: ============= This document may be freely distributed through any channels as long as the contents are kept unmodified. Commercial use of the information in the document is not allowed without written permission from HexView signed by our pgp key. HexView Disclosure Policy: ========================== HexView notifies vendors that have publicly available contact e-mail 24 hours before disclosing any information to the public. If we are unable to find vendor's e-mail address or if no reply is received within 24 hours, HexView will publish vulnerability notification including all technical details unless the issue is rated as "critical". If vendor does not reply within 72 hours, HexView may disclose all details for critical vulnerabilities as well. If vendor replies within the above mentioned time period, HexView will announce the vulnerability, but will not disclose the details required to reproduce it. HexView will also specify the date when full disclosure containing all the details will be published. The time period between announcement and full disclosure is 30 days unless there is an agreement with vendor and appropriate justification for extension. If vendor resolves the issue earlier than 30 days after announcement, HexView will publish full disclosure as soon as the fix is available to the public. HexView also reserves the right to publish any detail of any vulnerability at any time. Feedback and comments: ====================== Feedback and questions about this disclosure are welcome at vtalk@xxxxxxxxxxx -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFBbr6lDPV1+KQrDqQRArfsAJ9LetHLRF5zvJkEejIU3QJp6QjhmACgj/Yj 1ozDg5ejkW3Fyc6W4cwAWlU= =heGu -----END PGP SIGNATURE-----
