Sign-up

ID

VAR-201311-0354


CVE

CVE-2013-6798


TITLE

Windows Or Mac OS X Run on BlackBerry Link Vulnerabilities that allow remote file access folder restrictions to be bypassed

Trust: 0.8

sources: JVNDB: JVNDB-2013-005162

DESCRIPTION

BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not properly determine the user account for execution of Peer Manager in certain situations involving successive logins with different accounts, which allows context-dependent attackers to bypass intended restrictions on remote file-access folders via IPv6 WebDAV requests, a different vulnerability than CVE-2013-3694. This vulnerability CVE-2013-3694 Is a different vulnerability.By the attacker, IPv6 WebDAV A remote file access folder restriction may be circumvented via a request. BlackBerry Link is prone to a remote security-bypass vulnerability. Successfully exploiting this issue may allow an attacker to bypass certain security restrictions and gain unauthorized access. BlackBerry Link is a mobile phone synchronization software developed by BlackBerry Canada. This software can synchronize music, pictures, videos and other data between BlackBerry mobile phone and computer via USB or Wi-Fi. The vulnerability stems from the program not properly identifying the user account that executes the Peer Manager component

Trust: 1.98

sources: NVD: CVE-2013-6798 // JVNDB: JVNDB-2013-005162 // BID: 63774 // VULHUB: VHN-66800

AFFECTED PRODUCTS

vendor:blackberrymodel:linkscope:eqversion:1.2.0.12

Trust: 1.6

vendor:blackberrymodel:linkscope:eqversion:1.0.1.12

Trust: 1.6

vendor:blackberrymodel:linkscope:eqversion:1.1.1.26

Trust: 1.6

vendor:blackberrymodel:linkscope:eqversion:1.1.1.41

Trust: 1.6

vendor:blackberrymodel:linkscope:lteversion:1.2.0.28

Trust: 1.0

vendor:blackberrymodel:linkscope:lteversion:1.1.1.26

Trust: 1.0

vendor:blackberrymodel:linkscope:ltversion:1.1.1 build 39 (mac os x)

Trust: 0.8

vendor:blackberrymodel:linkscope:ltversion:1.2.1.31 (windows)

Trust: 0.8

vendor:blackberrymodel:linkscope:eqversion:1.2.0.28

Trust: 0.6

vendor:blackberrymodel:link for mac os (buildscope:eqversion:1.1.135)

Trust: 0.3

vendor:blackberrymodel:link for mac os (buildscope:eqversion:1.0.16)

Trust: 0.3

vendor:blackberrymodel:link for windowsscope:eqversion:1.2.0.28

Trust: 0.3

vendor:blackberrymodel:link for windowsscope:eqversion:1.0.1.12

Trust: 0.3

vendor:blackberrymodel:link for windowsscope:neversion:1.2.1.31

Trust: 0.3

vendor:blackberrymodel:link for mac os (buildscope:neversion:1.1.139)

Trust: 0.3

sources: BID: 63774 // JVNDB: JVNDB-2013-005162 // CNNVD: CNNVD-201311-231 // NVD: CVE-2013-6798

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-6798
value: MEDIUM

Trust: 1.0

NVD: CVE-2013-6798
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201311-231
value: MEDIUM

Trust: 0.6

VULHUB: VHN-66800
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2013-6798
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-66800
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-66800 // JVNDB: JVNDB-2013-005162 // CNNVD: CNNVD-201311-231 // NVD: CVE-2013-6798

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-66800 // JVNDB: JVNDB-2013-005162 // NVD: CVE-2013-6798

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201311-231

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201311-231

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-005162

PATCH
title:KB35315url:http://www.blackberry.com/btsc/KB35315
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-005162

EXTERNAL IDS
db:NVDid:CVE-2013-6798
Trust: 2.8
db:JVNDBid:JVNDB-2013-005162
Trust: 0.8
db:CNNVDid:CNNVD-201311-231
Trust: 0.7
db:BIDid:63774
Trust: 0.4
db:VULHUBid:VHN-66800
Trust: 0.1
sources:
            
            
            VULHUB: VHN-66800 // 
            
            
            
            BID: 63774 // 
            
            
            
            JVNDB: JVNDB-2013-005162 // 
            
            
            
            CNNVD: CNNVD-201311-231 // 
            
            
            
            NVD: CVE-2013-6798

REFERENCES
url:http://www.blackberry.com/btsc/kb35315
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/89202
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-6798
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-6798
Trust: 0.8
url:http://us.blackberry.com/software/desktop/blackberry-link.html
Trust: 0.3
url:http://btsc.webapps.blackberry.com/btsc/viewdocument.do;jsessionid=bf435d5437f9ab09f1d31f4fa8a184c3?externalid=kb35315&sliceid=1&cmd=&nocount=true&vieweddocslisthelper=com.kanisa.apps.common.baseviewe
Trust: 0.3
sources:
            
            
            VULHUB: VHN-66800 // 
            
            
            
            BID: 63774 // 
            
            
            
            JVNDB: JVNDB-2013-005162 // 
            
            
            
            CNNVD: CNNVD-201311-231 // 
            
            
            
            NVD: CVE-2013-6798

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 63774

SOURCES
db:VULHUBid:VHN-66800
db:BIDid:63774
db:JVNDBid:JVNDB-2013-005162
db:CNNVDid:CNNVD-201311-231
db:NVDid:CVE-2013-6798

LAST UPDATE DATE
2025-04-11T23:11:58.809000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-66800date:2017-08-29T00:00:00
db:BIDid:63774date:2013-11-12T00:00:00
db:JVNDBid:JVNDB-2013-005162date:2013-11-20T00:00:00
db:CNNVDid:CNNVD-201311-231date:2013-12-04T00:00:00
db:NVDid:CVE-2013-6798date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:VULHUBid:VHN-66800date:2013-11-18T00:00:00
db:BIDid:63774date:2013-11-12T00:00:00
db:JVNDBid:JVNDB-2013-005162date:2013-11-20T00:00:00
db:CNNVDid:CNNVD-201311-231date:2013-11-18T00:00:00
db:NVDid:CVE-2013-6798date:2013-11-18T02:55:09.797