Detections
Analytics
BlackBerry Desktop Manager Intellisync ActiveX Control Arbitrary Remote Code Execution
high Nessus Plugin ID 42370
Synopsis
The remote Windows host has an ActiveX control that is allows remote execution of arbitrary code.Description
The version of the Lotus Notes Intellisync component ('lnsresobject.dll') included with the BlackBerry Desktop Software installation on the remote host reportedly contains an unspecified error that can be exploited to execute arbitrary code.If an attacker can trick a user on the affected host into viewing a specially crafted HTML document, he can leverage this issue to execute arbitrary code on the affected system subject to the user's privileges.
Solution
Upgrade to BlackBerry Desktop Software version 5.0.1 or later.See Also
https://salesforce.services.blackberry.com/kbredirect/viewContent.do?externalId=KB19701
Plugin Details
Severity: High
ID: 42370
File Name: blackberry_intellisync_activex_cmd_exec.nasl
Version: 1.14
Type: local
Agent: windows
Family: Windows
Published: 11/4/2009
Updated: 11/15/2018
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 6.9
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
Required KB Items: SMB/Registry/Enumerated
Exploit Ease: No known exploits are available
Patch Publication Date: 11/3/2009
Vulnerability Publication Date: 11/3/2009
Reference Information
CVE: CVE-2009-0306
BID: 36903