Maintenance Addendum BlackBerry Smartphone Versions 4.6.1 and 4.7.1

Maintenance Report

BlackBerry® Smartphone Versions 4.6.1 and 4.7.1

Issued by:

Communications Security Establishment Canada

Certification Body

Canadian Common Criteria Evaluation and Certification Scheme

Document number	383-7-42-MR
Version	1.0
Date	11 September 2009

Introduction

Research In Motion Limited has submitted (via EWA-Canada) the Impact Analysis Report (IAR) for BlackBerry® Smartphone Versions 4.6.1 and 4.7.1, satisfying the requirements outlined in Version 1.0 of the Common Criteria document CCIMB-2004-02-009: Assurance Continuity: CCRA Requirements. In accordance with those requirements, the IAR describes the changes made to BlackBerry® Smartphone Version 4.6.1 and 4.7.0 (the maintained Target of Evaluation), the evidence updated as a result of the changes and the security impact of the changes.

Description of Changes to the TOE

The following characterizes the changes implemented in the BlackBerry® Smartphone Versions 4.6.1 and 4.7.1. For each change, it was verified that there were no required changes to the security functional requirements in the ST, and thorough functional and regression testing was conducted by the developer to ensure that the assurance in the Target of Evaluation (TOE) was maintained. The changes in the BlackBerry® Smartphone Versions 4.6.1 and 4.7.1 comprise bug fixes.

Description of Changes to the IT Environment

Changes to the underlying IT environment are permissible under assurance continuity provided that they do not change the certified TOE. Research In Motion Limited subjected the TOE to complete regression testing on all platforms. Changes to the IT environments hardware are:

BlackBerry® Smartphone Version 4.6.1 Bundle 424 executing on the BlackBerry Curve^TM 8520;
BlackBerry® Smartphone Version 4.6.1 Bundle 411 executing on the BlackBerry Curve^TM 8520;
BlackBerry® Smartphone Version 4.6.1 Bundle 409 executing on the BlackBerry Curve^TM 8520; and
BlackBerry® Smartphone Version 4.7.1 Bundle 77 executing on the BlackBerry Tour^TM 9630.

Affected Developer Evidence

Modifications to the product necessitated changes to a subset of the developer evidence that was previously submitted for the TOE. The set of affected developer evidence was identified in the IAR.

Conclusions

All changes to the TOE were bug fixes. Through functional and regression testing of the BlackBerry® Smartphone Versions 4.6.1 and 4.7.1 assurance gained in the original TOE certification was maintained. As all of the changes to the TOE have been classified as minor, it is the conclusion of the CB that the maintained TOE is appropriate for assurance continuity and re-evaluation is not required.