Vulnerability Note VU#829400

Research in Motion (RIM) BlackBerry Handheld web browser does not properly handle Java Application Description (JAD) files

If the JAD file is formatted to contain a long application name and vendor string (i.e., 256 or more characters) to your BlackBerry device, the browser appears to stop responding.
...
A browser dialog is not properly dismissed. The browser displays the application name or vendor string on the download screen (this appears as several lines). The long application name indicates that there may be problems with the JAD file and caution should be exercised when downloading the application.

According to RIM Technical Knowledge Center article KB-04755: "Install BlackBerry Device Software 4.0.2 or later. To obtain the most recent version of the device software, contact your service provider."

Bypass browser dialog

To bypass the browser dialog, start a new browser application, or click on a URL from an email message.

Reset BlackBerry Handheld device

If necessary, reset the BlackBerry Handheld by removing and re-inserting the battery.

Systems Affected

http://events.ccc.de/congress/2005/fahrplan/events/596.en.html
http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8021/7925/8142/?nodeid=1167791
http://www.blackberry.com/knowledgecenterpublic/livelink.exe/?func=doc.Fetch&nodeId=739746

Credit

This vulnerability was reported by FX of Phenoelit. Thanks to RIM for information used in this document.

This document was written by Art Manion.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.