Details of VAR-201311-0076

ID

VAR-201311-0076

CVE

CVE-2013-3694

TITLE

Windows Or Mac OS X Run on BlackBerry Link Vulnerable to reading arbitrary files

Trust: 0.8

sources: JVNDB: JVNDB-2013-005163

DESCRIPTION

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for remote file-access folders, which allows remote attackers to read or create arbitrary files via IPv6 WebDAV requests, as demonstrated by a CSRF attack involving DNS rebinding. BlackBerry Link is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to execute arbitrary code with elevated privileges within the context of user running the affected application. BlackBerry Link is a mobile phone synchronization software developed by BlackBerry Canada. This software can synchronize music, pictures, videos and other data between BlackBerry mobile phone and computer via USB or Wi-Fi. The vulnerability stems from the fact that the program does not require authentication for remote file access

Trust: 1.98

sources: NVD: CVE-2013-3694 // JVNDB: JVNDB-2013-005163 // BID: 63695 // VULHUB: VHN-63696

AFFECTED PRODUCTS

vendor:	blackberry	model:	link	scope:	eq	version:	1.2.0.12	Trust: 1.6
vendor:	blackberry	model:	link	scope:	eq	version:	1.0.1.12	Trust: 1.6
vendor:	blackberry	model:	link	scope:	eq	version:	1.1.1.26	Trust: 1.6
vendor:	blackberry	model:	link	scope:	eq	version:	1.1.1.41	Trust: 1.6
vendor:	blackberry	model:	link	scope:	lte	version:	1.2.0.28	Trust: 1.0
vendor:	blackberry	model:	link	scope:	lte	version:	1.1.1.26	Trust: 1.0
vendor:	blackberry	model:	link	scope:	lt	version:	1.1.1 build 39 (mac os x)	Trust: 0.8
vendor:	blackberry	model:	link	scope:	lt	version:	1.2.1.31 (windows)	Trust: 0.8
vendor:	blackberry	model:	link	scope:	eq	version:	1.2.0.28	Trust: 0.6
vendor:	blackberry	model:	link for mac os (build	scope:	eq	version:	1.1.135)	Trust: 0.3
vendor:	blackberry	model:	link for mac os (build	scope:	eq	version:	1.0.16)	Trust: 0.3
vendor:	blackberry	model:	link for windows	scope:	eq	version:	1.2.0.28	Trust: 0.3
vendor:	blackberry	model:	link for windows	scope:	eq	version:	1.0.1.12	Trust: 0.3
vendor:	blackberry	model:	link for windows	scope:	ne	version:	1.2.1.31	Trust: 0.3
vendor:	blackberry	model:	link for mac os (build	scope:	ne	version:	1.1.139)	Trust: 0.3

sources: BID: 63695 // JVNDB: JVNDB-2013-005163 // CNNVD: CNNVD-201311-210 // NVD: CVE-2013-3694

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-3694
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2013-3694
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201311-210
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-63696
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2013-3694
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-63696
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-63696 // JVNDB: JVNDB-2013-005163 // CNNVD: CNNVD-201311-210 // NVD: CVE-2013-3694

PROBLEMTYPE DATA

problemtype:

CWE-352

Trust: 1.9

sources: VULHUB: VHN-63696 // JVNDB: JVNDB-2013-005163 // NVD: CVE-2013-3694

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201311-210

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201311-210

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-005163

PATCH

title:	KB35315	url:	http://www.blackberry.com/btsc/KB35315	Trust: 0.8
title:	BlackBerry Link	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=46796	Trust: 0.6
title:	122_b010_multilanguage	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=46795	Trust: 0.6

sources: JVNDB: JVNDB-2013-005163 // CNNVD: CNNVD-201311-210

EXTERNAL IDS

db:	NVD	id:	CVE-2013-3694	Trust: 2.8
db:	BID	id:	63695	Trust: 1.0
db:	JVNDB	id:	JVNDB-2013-005163	Trust: 0.8
db:	CNNVD	id:	CNNVD-201311-210	Trust: 0.7
db:	VULHUB	id:	VHN-63696	Trust: 0.1

sources: VULHUB: VHN-63696 // BID: 63695 // JVNDB: JVNDB-2013-005163 // CNNVD: CNNVD-201311-210 // NVD: CVE-2013-3694

REFERENCES

url:	http://blog.cmpxchg8b.com/2013/11/qnx.html	Trust: 2.0
url:	http://www.blackberry.com/btsc/kb35315	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-3694	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-3694	Trust: 0.8
url:	http://www.securityfocus.com/bid/63695	Trust: 0.6
url:	http://us.blackberry.com/software/desktop/blackberry-link.html	Trust: 0.3
url:	http://btsc.webapps.blackberry.com/btsc/viewdocument.do;jsessionid=bf435d5437f9ab09f1d31f4fa8a184c3?externalid=kb35315&sliceid=1&cmd=&nocount=true&vieweddocslisthelper=com.kanisa.apps.common.baseviewe	Trust: 0.3

sources: VULHUB: VHN-63696 // BID: 63695 // JVNDB: JVNDB-2013-005163 // CNNVD: CNNVD-201311-210 // NVD: CVE-2013-3694

CREDITS

Tavis Ormandy and Ollie Whitehouse

Trust: 0.9

sources: BID: 63695 // CNNVD: CNNVD-201311-210

SOURCES

db:	VULHUB	id:	VHN-63696
db:	BID	id:	63695
db:	JVNDB	id:	JVNDB-2013-005163
db:	CNNVD	id:	CNNVD-201311-210
db:	NVD	id:	CVE-2013-3694

LAST UPDATE DATE

2025-04-11T22:53:10.667000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-63696	date:	2013-11-19T00:00:00
db:	BID	id:	63695	date:	2013-11-12T00:00:00
db:	JVNDB	id:	JVNDB-2013-005163	date:	2013-11-20T00:00:00
db:	CNNVD	id:	CNNVD-201311-210	date:	2013-12-13T00:00:00
db:	NVD	id:	CVE-2013-3694	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-63696	date:	2013-11-18T00:00:00
db:	BID	id:	63695	date:	2013-11-12T00:00:00
db:	JVNDB	id:	JVNDB-2013-005163	date:	2013-11-20T00:00:00
db:	CNNVD	id:	CNNVD-201311-210	date:	2013-11-12T00:00:00
db:	NVD	id:	CVE-2013-3694	date:	2013-11-18T03:55:05.603