# MA-301.032012: MyCERT Alert - Critical Vulnerability in Webkit Browser Engine for BlackBerry

**Date:** 08 Mar 2012  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-301.032012  
**Advisory ID:** MA-301.032012

---

**1.0 Introduction**
A critical vulnerability has been identified in the Webkit browser engine for BlackBerry smartphones running BlackBerry 6, BlackBerry 7, and BlackBerry 7.1. A successful attack could result in remote code execution (RCE) on a smartphone running BlackBerry 6, BlackBerry 7, and BlackBerry 7.1 and BlackBerry Tablet OS versions 1.x and 2.0
The vulnerability is caused due to an unspecified error in the WebKit browser engine. No further information is currently available.
**2.0 Impact**
An attacker exploiting this vulnerability could read or write to the built-in media storage section of a BlackBerry smartphone or to the media card. The attacker cannot access user data that the email, calendar, and contact applications store in the application storage (the internal file system that stores application data and user data) of the BlackBerry smartphone.
**3.0 Affected Products**
- BlackBerry OS versions 6, 7, and 7.1
- BlackBerry Tablet OS versions 1.x and 2.0
**4.0 Recommendation**
As of the writing of this advisory, Research In Motion Limited has not released any security patches for this vulnerability. However, as a workaround, the vendor recommends to restrict browsing to trusted sites or disable the browser
**4.1 Restrict BlackBerry smartphone users to only browse trusted websites via BlackBerry MDS Connection Service**
BlackBerry Enterprise Server administrators can force all browser traffic in their organization to use the BlackBerry MDS Connection Service to restrict browsing to their organization's intranet or to specific trusted sites. Administrators can configure the BlackBerry MDS Connection Service to use a proxy or web filtering service to block untrusted sites. The steps will also prevent the browser from failing over to unrestricted browsing via the BlackBerry Internet Service if the user's BlackBerry Enterprise Server is unavailable. If this occurs, the user sees the error message, "A communication failure occurred with the selected Mobile Data Service. The server may be busy, please try again later. If the problem persists contact your administrator".
To force traffic through the BlackBerry MDS Connection Service, BlackBerry Enterprise Server administrators need to complete the following steps:
- Click Browser policy group
- Set the Allow IBS Browser to No.
- Set the Allow Hotspot Browser to Disallow.
- Click Device only policy group
- Set the Enable WAP Config to No.
- Click Service Exclusivity policy group
- Set the Allow Other Browser Services to No.
- Click Global policy group
- Set the Allow Browser to Yes.
- Configure the Mobile Data Service to use a proxy or web filtering service. (See http://www.blackberry.com/btsc/KB15673 for more information).
**4.2 Disable the BlackBerry Browser**
If you are a BlackBerry Enterprise Server administrator, you can disable the BlackBerry Browser on BlackBerry smartphones in your organization using the Allow Browser IT policy rule and the Allow Other Browser Services IT policy rule.
To disable the BlackBerry Browser, complete the followings steps in the IT policy or policies:
- Click Service Exclusivity policy group.
- Set Allow Other Browser Services to False.
- Click Global items.
- Set Allow Browser to False.
Users are also recommended not to click on suspicious/unknown URL received via email, IM or any social networking client on the affected BlackBerry devices.
MyCERT would like to advise the users of this product to be vigilant of the latest security announcements by Research In Motion Limited.
MyCERT can be reached through the following channels for further assistance:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#cca1b5afa9beb88ca1b5afa9beb8e2a3beabe2a1b5)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
i. <http://btsc.webapps.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB30152>
ii.<http://secunia.com/advisories/48263/>