From Research in Motion's KB-04791 (sorry, long link):
http://www.blackberry.com/knowledgec...81753&vernum=2

Applies to:
BlackBerry Enterprise Server® 2.2 and later for IBM® Lotus Domino®
BlackBerry Enterprise Server® 3.6 and later for Microsoft® Exchange
BlackBerry Enterprise Server® 4.0 and later for Novell® GroupWise®

Background: An internal analysis has identified an issue in the BlackBerry Enterprise Server that is known to Research In Motion® and has been corrected in current or upcoming software releases.

Problem: A corrupt Microsoft Word (.doc) file opened on a BlackBerry® wireless device could potentially provide a means to execute arbitrary code on the BlackBerry Attachment Service component of the BlackBerry Enterprise Server.

Resolution: Depending on your environment and the BlackBerry Enterprise Server version, install the appropriate software upgrades.