Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2019-8921

Опубликовано: 25 фев. 2019
Источник: redhat
CVSS3: 6.5
EPSS Низкий

Описание

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.

An issue was discovered in bluetoothd in BlueZ through version 5.48. The vulnerability lies in the handling of buffered data where it is possible to cause the server to return more bytes than the buffer actually holds, resulting in leaking arbitrary heap data.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 6bluezOut of support scope
Red Hat Enterprise Linux 7bluezWill not fix
Red Hat Enterprise Linux 8bluezNot affected
Red Hat Enterprise Linux 9bluezNot affected

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-20->CWE-200
https://bugzilla.redhat.com/show_bug.cgi?id=2027458bluez: information leak in service_attr_req() in sdpd-request.c via a crafted CSTATE

EPSS

Процентиль: 9%
0.00032
Низкий

6.5 Medium

CVSS3

Связанные уязвимости

CVSS3: 6.5
ubuntu
около 4 лет назад

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.

CVSS3: 6.5
nvd
около 4 лет назад

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.

CVSS3: 6.5
debian
около 4 лет назад

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulne ...

CVSS3: 6.5
github
около 4 лет назад

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the same.

CVSS3: 6.5
fstec
почти 7 лет назад

Уязвимость реализации службы SDP стека протоколов Bluetooth для ОС Linux BlueZ, позволяющая нарушителю раскрыть защищаемую информацию

EPSS

Процентиль: 9%
0.00032
Низкий

6.5 Medium

CVSS3