Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2024-01454

Опубликовано: 22 мар. 2023
Источник: fstec
CVSS3: 7.1
CVSS2: 6.8
EPSS Низкий

Описание

Уязвимость реализации протокола AVRCP стека протоколов Bluetooth для ОС Linux BlueZ связана с непроверенным индексированием массива. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код с правами root

Вендор

Novell Inc.
ООО «Ред Софт»
BlueZ Project
ООО «РусБИТех-Астра»

Наименование ПО

SUSE Linux Enterprise Server for SAP Applications
OpenSUSE Leap
Suse Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
SUSE OpenStack Cloud
SUSE Linux Enterprise Workstation Extension
openSUSE Tumbleweed
SUSE CaaS Platform
SUSE Linux Enterprise High Performance Computing
РЕД ОС
SUSE Manager Proxy
SUSE Manager Server
SUSE Enterprise Storage
Suse Linux Enterprise Desktop
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Linux Enterprise Real Time
SUSE Linux Enterprise Module for Basesystem
BlueZ
Astra Linux Special Edition

Версия ПО

12 SP4 (SUSE Linux Enterprise Server for SAP Applications)
15.5 (OpenSUSE Leap)
12 SP2-BCL (Suse Linux Enterprise Server)
15 SP1 (SUSE Linux Enterprise Server for SAP Applications)
12 SP5 (Suse Linux Enterprise Server)
12 SP5 (SUSE Linux Enterprise Server for SAP Applications)
12 SP5 (SUSE Linux Enterprise Software Development Kit)
9 (SUSE OpenStack Cloud)
12 SP5 (SUSE Linux Enterprise Workstation Extension)
- (openSUSE Tumbleweed)
Crowbar 9 (SUSE OpenStack Cloud)
12 SP4-ESPOS (Suse Linux Enterprise Server)
4.0 (SUSE CaaS Platform)
12 SP4-LTSS (Suse Linux Enterprise Server)
15 SP1-LTSS (Suse Linux Enterprise Server)
15 SP1-LTSS (SUSE Linux Enterprise High Performance Computing)
7.3 (РЕД ОС)
15.4 (OpenSUSE Leap)
15 SP3 (SUSE Linux Enterprise Server for SAP Applications)
4.2 (SUSE Manager Proxy)
4.2 (SUSE Manager Server)
7 (SUSE Enterprise Storage)
15 SP2 (SUSE Linux Enterprise Server for SAP Applications)
15 SP2-LTSS (SUSE Linux Enterprise High Performance Computing)
15 SP4 (Suse Linux Enterprise Server)
15 SP4 (Suse Linux Enterprise Desktop)
15 SP4 (SUSE Linux Enterprise Server for SAP Applications)
4.2 (SUSE Manager Retail Branch Server)
15 SP2-LTSS (Suse Linux Enterprise Server)
4.3 (SUSE Manager Retail Branch Server)
4.3 (SUSE Manager Proxy)
4.3 (SUSE Manager Server)
15 SP4 (SUSE Linux Enterprise High Performance Computing)
7.1 (SUSE Enterprise Storage)
15 SP4 (SUSE Linux Enterprise Module for Desktop Applications)
15 SP4 (SUSE Linux Enterprise Workstation Extension)
5.3 (SUSE Linux Enterprise Micro)
5.3 (openSUSE Leap Micro)
15 SP3-LTSS (Suse Linux Enterprise Server)
15 SP3-ESPOS (SUSE Linux Enterprise High Performance Computing)
15 SP3-LTSS (SUSE Linux Enterprise High Performance Computing)
15 SP3 (SUSE Linux Enterprise Real Time)
15 SP5 (SUSE Linux Enterprise Server for SAP Applications)
15 SP5 (Suse Linux Enterprise Server)
15 SP5 (Suse Linux Enterprise Desktop)
15 SP5 (SUSE Linux Enterprise High Performance Computing)
15 SP5 (SUSE Linux Enterprise Module for Basesystem)
5.4 (SUSE Linux Enterprise Micro)
5.4 (openSUSE Leap Micro)
15 SP5 (SUSE Linux Enterprise Module for Desktop Applications)
15 SP5 (SUSE Linux Enterprise Workstation Extension)
от 5.0 до 5.66 (BlueZ)
1.8 (Astra Linux Special Edition)

Тип ПО

Операционная система
Прикладное ПО информационных систем
Сетевое средство

Операционные системы и аппаратные платформы

ООО «Ред Софт» РЕД ОС 7.3
ООО «РусБИТех-Астра» Astra Linux Special Edition 1.8

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 6,8)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 7,1)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для BlueZ
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=f54299a850676d92c3dafd83e9174fcfe420ccc9
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2023-27349.html
Для РедОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/
Для ОС Astra Linux:
обновить пакет bluez до 5.66-1+deb12u2+ci202410041818+astra1 или более высокой версии, используя рекомендации производителя: https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Существует

Информация об устранении

Уязвимость устранена

EPSS

Процентиль: 91%
0.07141
Низкий

7.1 High

CVSS3

6.8 Medium

CVSS2

Связанные уязвимости

CVSS3: 7.1
ubuntu
около 1 года назад

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

CVSS3: 7.1
redhat
около 1 года назад

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

CVSS3: 7.1
nvd
около 1 года назад

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious device. The specific flaw exists within the handling of the AVRCP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19908.

CVSS3: 7.1
debian
около 1 года назад

BlueZ Audio Profile AVRCP Improper Validation of Array Index Remote Co ...

suse-cvrf
около 2 лет назад

Security update for bluez

EPSS

Процентиль: 91%
0.07141
Низкий

7.1 High

CVSS3

6.8 Medium

CVSS2