Sign-up

ID

VAR-202002-0035


CVE

CVE-2012-5828


TITLE

BlackBerry PlayBook Vulnerability regarding information leakage in

Trust: 0.8

sources: JVNDB: JVNDB-2012-006623

DESCRIPTION

BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error. It highlights game, media publishing and collaboration features. An attacker can exploit a vulnerability by enticing a trusted user to view a specially crafted website, resulting in the disclosure of potentially sensitive information. NOTE: Very limited information is currently available regarding this issue. We will update this BID as more information emerges. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Nth Dimension Security Advisory (NDSA20121030) Date: 30th October 2012 Author: Tim Brown <mailto:timb@nth-dimension.org.uk> URL: <http://www.nth-dimension.org.uk/> / <http://www.machine.org.uk/> Product: RIM BlackBerry PlayBook OS 1.0.8.6067 <http://www.rim.com/products/blackberry_tablets.shtml> Vendor: RIM <http://www.rim.com/> Risk: Low Summary The web browser which comes as part of the RIM BlackBerry PlayBook OS can be tricked into disclosing the contents of local files through the planting of a malicious HTML file through the standard download mechanism. It should be noted that in order to exploit this issue, user interaction is required as the user will need to confirm the download of the malicious HTML file. After discussions with the vendor, CVE-2012-5828 was assigned to this vulnerability. Solutions Nth Dimension recommends that the vendor supplied patches should be applied. Technical Details It was identified that the PlayBook web browser could be forced to download rather than render HTML files and that whilst the browser does prompt the user to confirm the location of the download, this download process defaults to an attacker chosen location. Furthermore, once downloaded, it is possible to use the "Location" header to load the file from the attacker's chose location using the "file://" URL handler in such a manner that the downloaded HTML then has trusted access to the PlayBook filing system. It is possible to craft a HTML download which when opened will lead to arbitrary JavaScript being executed in the local context. The "file://" URL handler is trusted to execute across domains. History On 12th February 2012, Nth Dimension supplied a PoC exploit for this issue to representatives of RIM. BBSIRT responded on the 20th to confirm that they had recieved the report and were investigating. RIM further notified Nth Dimension to confirm that all reported vulnerabilities were handled based on CVSS and that only critical vulnerabilities were deemed candidates for out-of-band patching. Less critical issues would however be addressed in future product updates. Nth Dimension responded on 7th March 2012 to confirm that they agreed with this approach and that in their opinion the issue was not critical and did not warrant an expedited response. Nth Dimension asked to be kept in the loop regarding the release of a patch for this issue in due course. On 19th September 2012, Nth Dimension asked for an update, in particular to establish whether a CVE had been assigned by RIM for this issue. On 1st November 2012, RIM responded to say that the "The changes for the issues are in the latest 2.1 builds for PlayBook. The build is currently available for WiFi only PlayBooks and we’re working with our carrier partners for testing and availability for build for the in-market cellular-enabled PlayBooks". On 6th November 2012, RIM confirm that CVE-2012-5828 has been assigned. They also confirm they believe testing of cellular PlayBooks will be completed by the end of the month. Nth Dimension repond, proposing 1st Deceber 2012 as the embargo date. Current As of 1st Novmeber 2012, the state of the vulnerability is believed to be as follows. RIM have begun shipping a patch which it is believed successfully resolves the reported issue. Thanks Nth Dimension would like to thank all the security folk at RIM, in particular the BlackBerry Incident Response team for the way they worked to resolve the issue. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBCAAGBQJQuU6xAAoJEPJhpTVyySo7xcoQAM7KB/2KYIq/IElrO15jr/hH 8Pytj9Q+k0VTmousVUWs5EP+uurZ28dGH8QNdsBv/kmp9M6gPQbex38pVVp+UJxh DcVoGhVJLsrzATQH+1LH/zVVkV4idERSQvGMjbikHWMdObfr6H37iN/UwK1+O27T tFQkIbM/rRNZk/OUz+B25D+2C53tdjTsCStkbnmYXKBlMYf0h3M28sFR3bcB5mBg MFNO7Vr/t16NdFRN+MPgfiRZTATH2gCqklMoe8rmQbu+Fumf1+7T5jlnXORUIiUb tTKvDjw9o0dL513b58JuIsheiyx0IlvGo4RyfXfWRAZaZiTPSnbzPwl83Bj1JpW+ PJ4Z+4yKcwQcRIfvCDH6vc8o4uMTM7g9SMuLxZBoZN3mFUAOLwy9wJde+w8bmpFA Z6KWtmzcAlt1QoRhNPS8s+udMc1HSXKpyNjTdaqEmhjVNReDeIp+mrOnlYENa4k+ 86LyOMlil00B+dCnt76/s3T/Q+briWgLgY7KrZlVIIoRzliTn3Oy0Rd7SIRJgoV6 bK5/W8q1uFEEF1kdy1Q3/08CFxIkWKgB6QCfa0iY5q+nNl5V6SjqAaxsesB/zcnS aD6OjWz+j9ZFs1nounIWZrGygLRVt3C/liLfR7JiAGux518mRz87uOedd+0TtBUh O7FtQ/d4H990AomSBivi =DyJj -----END PGP SIGNATURE-----

Trust: 2.61

sources: NVD: CVE-2012-5828 // JVNDB: JVNDB-2012-006623 // CNVD: CNVD-2012-9330 // BID: 56793 // VULMON: CVE-2012-5828 // PACKETSTORM: 118538

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2012-9330

AFFECTED PRODUCTS

vendor:blackberrymodel:playbookscope:ltversion:2.1

Trust: 1.0

vendor:blackberrymodel:playbookscope:eqversion:2.1

Trust: 0.8

vendor:researchmodel:in motion blackberry playbook tablet softwarescope:eqversion:1.0.6

Trust: 0.6

vendor:researchmodel:in motion blackberry playbook tablet softwarescope:eqversion:1.0.7.3312

Trust: 0.6

vendor:researchmodel:in motion blackberry playbook tablet softwarescope:eqversion:1.0.5.2304

Trust: 0.6

vendor:researchmodel:in motion blackberry playbook tablet softwarescope:eqversion:1.0.5.2342

Trust: 0.6

vendor:researchmodel:in motion blackberry playbook tablet softwarescope:eqversion:1.0.7.2942

Trust: 0.6

vendor:researchmodel:in motion blackberry playbook tablet softwarescope:eqversion:1.0.8.4985

Trust: 0.6

vendor:researchmodel:in motion blackberry playbook tablet softwarescope:eqversion:1.0.8.6067

Trust: 0.6

vendor:researchmodel:in motion blackberry playbook tablet softwarescope:eqversion:2.0.0.7971

Trust: 0.6

vendor:researchmodel:in motion blackberry playbookscope:eqversion:2.0.0.7971

Trust: 0.6

vendor:rimmodel:blackberry playbook tablet softwarescope:eqversion:2.0.1.668

Trust: 0.3

vendor:rimmodel:blackberry playbook tablet softwarescope:eqversion:2.0.1.358

Trust: 0.3

vendor:rimmodel:blackberry playbook tablet softwarescope:eqversion:2.0.0.7971

Trust: 0.3

vendor:rimmodel:blackberry playbook tablet softwarescope:eqversion:1.0.8.6067

Trust: 0.3

vendor:rimmodel:blackberry playbook tablet softwarescope:eqversion:1.0.8.4985

Trust: 0.3

vendor:rimmodel:blackberry playbook tablet softwarescope:eqversion:1.0.7.3312

Trust: 0.3

vendor:rimmodel:blackberry playbook tablet softwarescope:eqversion:1.0.7.2942

Trust: 0.3

vendor:rimmodel:blackberry playbook tablet softwarescope:eqversion:1.0.6

Trust: 0.3

vendor:rimmodel:blackberry playbook tablet softwarescope:eqversion:1.0.5.2342

Trust: 0.3

vendor:rimmodel:blackberry playbook tablet softwarescope:eqversion:1.0.5.2304

Trust: 0.3

vendor:rimmodel:blackberry playbookscope:eqversion:2.0.0.7971

Trust: 0.3

sources: CNVD: CNVD-2012-9330 // BID: 56793 // JVNDB: JVNDB-2012-006623 // NVD: CVE-2012-5828

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2012-5828
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2012-006623
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201212-146
value: MEDIUM

Trust: 0.6

VULMON: CVE-2012-5828
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2012-5828
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: JVNDB-2012-006623
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

nvd@nist.gov: CVE-2012-5828
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: JVNDB-2012-006623
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULMON: CVE-2012-5828 // JVNDB: JVNDB-2012-006623 // CNNVD: CNNVD-201212-146 // NVD: CVE-2012-5828

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.8

sources: JVNDB: JVNDB-2012-006623 // NVD: CVE-2012-5828

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201212-146

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201212-146

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2012-006623

PATCH
title:Top Pageurl:http://support.blackberry.com/
Trust: 0.8
title:BlackBerry PlayBook has an undisclosed information disclosure vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/26975
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2012-9330 // 
            
            
            
            JVNDB: JVNDB-2012-006623

EXTERNAL IDS
db:NVDid:CVE-2012-5828
Trust: 3.5
db:BIDid:56793
Trust: 2.6
db:JVNDBid:JVNDB-2012-006623
Trust: 0.8
db:CNVDid:CNVD-2012-9330
Trust: 0.6
db:CNNVDid:CNNVD-201212-146
Trust: 0.6
db:VULMONid:CVE-2012-5828
Trust: 0.1
db:PACKETSTORMid:118538
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2012-9330 // 
            
            
            
            VULMON: CVE-2012-5828 // 
            
            
            
            BID: 56793 // 
            
            
            
            JVNDB: JVNDB-2012-006623 // 
            
            
            
            PACKETSTORM: 118538 // 
            
            
            
            CNNVD: CNNVD-201212-146 // 
            
            
            
            NVD: CVE-2012-5828

REFERENCES
url:https://www.securityfocus.com/archive/1/524893/30/9240/flat
Trust: 2.5
url:http://www.securityfocus.com/bid/56793
Trust: 1.8
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/80555
Trust: 1.7
url:https://packetstormsecurity.com/files/cve/cve-2012-5828
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2012-5828
Trust: 1.5
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-5828
Trust: 0.8
url:http://www.securityfocus.com/bid/56793http
Trust: 0.6
url:http://us.blackberry.com/playbook-tablet.html
Trust: 0.3
url:http://seclists.org/fulldisclosure/2012/dec/23
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/200.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:http://www.nth-dimension.org.uk/>
Trust: 0.1
url:http://www.rim.com/products/blackberry_tablets.shtml>
Trust: 0.1
url:http://www.machine.org.uk/>
Trust: 0.1
url:http://www.rim.com/>
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2012-9330 // 
            
            
            
            VULMON: CVE-2012-5828 // 
            
            
            
            BID: 56793 // 
            
            
            
            JVNDB: JVNDB-2012-006623 // 
            
            
            
            PACKETSTORM: 118538 // 
            
            
            
            CNNVD: CNNVD-201212-146 // 
            
            
            
            NVD: CVE-2012-5828

CREDITS
Nth Dimension
Trust: 0.9
sources:
            
            
            BID: 56793 // 
            
            
            
            CNNVD: CNNVD-201212-146

SOURCES
db:CNVDid:CNVD-2012-9330
db:VULMONid:CVE-2012-5828
db:BIDid:56793
db:JVNDBid:JVNDB-2012-006623
db:PACKETSTORMid:118538
db:CNNVDid:CNNVD-201212-146
db:NVDid:CVE-2012-5828

LAST UPDATE DATE
2024-08-14T15:02:01.498000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2012-9330date:2012-12-27T00:00:00
db:VULMONid:CVE-2012-5828date:2020-02-14T00:00:00
db:BIDid:56793date:2012-12-01T00:00:00
db:JVNDBid:JVNDB-2012-006623date:2020-03-02T00:00:00
db:CNNVDid:CNNVD-201212-146date:2020-05-26T00:00:00
db:NVDid:CVE-2012-5828date:2020-02-14T17:09:40.083

SOURCES RELEASE DATE
db:CNVDid:CNVD-2012-9330date:2012-12-27T00:00:00
db:VULMONid:CVE-2012-5828date:2020-02-10T00:00:00
db:BIDid:56793date:2012-12-01T00:00:00
db:JVNDBid:JVNDB-2012-006623date:2020-03-02T00:00:00
db:PACKETSTORMid:118538date:2012-12-01T13:33:33
db:CNNVDid:CNNVD-201212-146date:2012-12-12T00:00:00
db:NVDid:CVE-2012-5828date:2020-02-10T16:15:11.610