Unscored severity · published Oct 25, 2014
CVE-2014-6611
The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3.0 does not properly…
–
CVSS
1%
EPSS
No
On KEV
Description
The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3.0 does not properly validate download/update requests, which allows user-assisted man-in-the-middle attackers to spoof servers and trigger the download of a crafted app by modifying the client-server data stream.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Blackberry OS · Blackberry
10.3.0; 10.2.1; 10.2.0 · source: NVD
BW
Blackberry World · Blackberry
through 5.1.0.52; through 5.0.0.262; through 5.0.0.261 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-6611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-6611
secunia.com
http://secunia.com/advisories/61013
Vendor Advisory
http://www.blackberry.com/btsc/kb36360
More from Blackberry OS
–
CVE-2014-2388
The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforce the password requirement for SMB filesystem access, which…
–
CVE-2014-2389
Stack-based buffer overflow in a certain decryption function in qconnDoor on BlackBerry Z10 devices with software 10.1.0.2312, when developer-mode has been previously enabled,…
–
CVE-2013-3692
BlackBerry 10 OS before 10.0.10.648 on BlackBerry Z10 smartphones uses weak permissions for a BlackBerry Protect object, which allows physically proximate attackers to bypass…