Good Mobile Messaging - Security Bulletin
Product: GMM Server
Date: 13 February 2009
Updated: 21 May 2009
Title: Good Mobile Messaging - Security Bulletin
This security bulletin addresses a potential vulnerability with one of the third party libraries used by Good Mobile Messaging Server for converting attachments to text when choosing the "View as Text" option from the Good Messaging client. While Good Messaging does not use the full suite of capabilities that these third party libraries provide and it is possible we do not suffer from this vulnerability, your organization may still be at risk. The potential vulnerability could allow an attacker to send an electronic mail message with an attachment to a Good Messaging user. When the user chooses to "View" the attachment, this vulnerability could be exploited resulting in the attacker gaining "Good Admin" user privileges.
Good Technology considers this vulnerability to be a very serious security issue and strongly recommends that you implement the fix in the resolution section of this KB.
Upgrade your Good Mobile Messaging Server to a hot fix version as noted below. The hot fix will replace the older libraries with newer libraries. The newer libraries address the vulnerability described above. This hot fix addresses a potential vulnerability with one of the third party libraries used by Good Mobile Messaging for converting attachments to text when choosing the "View as Text” option from the Good Messaging client. This hot fix shall be applied against Good Messaging Server for Exchange and to Good Messaging Server for Exchange.
This resolution applies to Good Messaging Server for Exchange and Good Messaging Server for Domino.
1. Download the hot fix for your corresponding Good Mobile Messaging server below.
2. Run the hot fix installer on each instance of Good Mobile Messaging Server. You do not have to upgrade Good Management Console or Good Mobile Control server (formerly known as Good Administration Center) or Good Mobile Access Server. (formerly known as Good Mobile Connection server or GMx).
Good Messaging Server for Exchange hot fix download:
Customers running Good Messaging for Exchange 220.127.116.11 simply upgrade to this hot fix version:
If applying hot fix to Good Messaging Server for Exchange 18.104.22.168 then use the following package:
Customers on older versions of Good Messaging Server for Exchange will have to upgrade to Good Messaging Server 22.214.171.124 first, in order to utilize this hot fix.
Good Messaging Server for Domino hot fix download:
If applying hot fix to Good Messaging for Domino 126.96.36.199 simply upgrade to this hot fix version:
If applying hot fix to Good Messaging for Domino 188.8.131.52 simply upgrade to this hot fix version:
Customers on older versions of Good Messaging for Domino will have to upgrade to Good Messaging Server 184.108.40.206 first, in order to utilize this hot fix.
(if the links do not work please cut and paste the address into your browser window)
Important: Please do not do a straight upgrade from 5.0 to 6.0. Visit our public documentation site at http://www.good.com/corp/int_support.php?id=492 for more info on how to migrate from Good 5.0 to Good 6.0.
Please remove GdFileConv.exe from the Good Mobile Messaging server. By default the file is found in C:\Program Files\Good Technology\Good Messaging Server\bin
1. Log into the machine with Good Mobile Messaging Server.
2. Shutdown the GoodLink Server service.
3. Remove the file GdFileConv.exe or optionally rename it
4. Restart the GoodLink Sever service
Please repeat the above steps with each machine that has an instance of Good Mobile Messaging server. If the Good Mobile Messaging server software is re-installed, or upgraded, then the file GdFileConv.exe will be re-installed and the above steps will need to be repeated.
When user chooses to 'View' as text on the Good Client, the following error will be displayed - "Cannot Download the attachment. Format conversion failed on the server".
Users can choose "View High Quality" which uses native viewers such as Pocket Word, Pocket Excel or Docs2Go on Palm OS devices instead of "View as Text" option. Please refer to Chapter 2 of the "User's Guide for All Supported Handhelds" for more information