Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2025-16170

Опубликовано: 15 авг. 2025
Источник: fstec
CVSS3: 2.6
CVSS2: 1.8
EPSS Низкий

Описание

Уязвимость реализации протокола OBEX стека протоколов Bluetooth для ОС Linux BlueZ связана с чтением за пределами допустимого диапазона. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить доступ к защищаемой информации

Вендор

ООО «НЦПР»
Сообщество свободного программного обеспечения

Наименование ПО

МСВСфера
BlueZ

Версия ПО

9.5 (МСВСфера)
до 5.72-2 (BlueZ)
5.66 (BlueZ)

Тип ПО

Операционная система
Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

ООО «НЦПР» МСВСфера 9.5

Уровень опасности уязвимости

Низкий уровень опасности (базовая оценка CVSS 2.0 составляет 1,8)
Низкий уровень опасности (базовая оценка CVSS 3.1 составляет 2,6)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для BlueZ:
https://tsn.miraclelinux.com/en/node/20298
Для МСВСфера:
https://errata.msvsphere-os.ru/definition/9/INFCSA-2024:9413?lang=ru

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Существует

Информация об устранении

Уязвимость устранена

EPSS

Процентиль: 11%
0.00038
Низкий

2.6 Low

CVSS3

1.8 Low

CVSS2

Связанные уязвимости

CVSS3: 5.7
ubuntu
больше 1 года назад

BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of OBEX protocol parameters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20937.

CVSS3: 2.6
redhat
больше 1 года назад

BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of OBEX protocol parameters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20937.

CVSS3: 5.7
nvd
больше 1 года назад

BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of OBEX protocol parameters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20937.

CVSS3: 5.7
debian
больше 1 года назад

BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerabi ...

CVSS3: 2.6
github
больше 1 года назад

BlueZ OBEX Library Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of OBEX protocol parameters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-20937.

EPSS

Процентиль: 11%
0.00038
Низкий

2.6 Low

CVSS3

1.8 Low

CVSS2