src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2008-0581 advisory.

    - Fix CVE-2008-2374     Resolves: #452880

    bluez-utils:

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An input validation flaw was found in the Bluetooth Session Description Protocol (SDP) packet parser used by the Bluez Bluetooth utilities. A Bluetooth device with an already-established trust relationship, or a local user registering a service record via a UNIX&reg; socket or D-Bus interface, could cause a crash, or possibly execute arbitrary code with privileges of the hcid daemon.
(CVE-2008-2374)

Updated bluez-libs and bluez-utils packages that fix a security flaw are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The bluez-libs package contains libraries for use in Bluetooth applications. The bluez-utils package contains Bluetooth daemons and utilities.

An input validation flaw was found in the Bluetooth Session Description Protocol (SDP) packet parser used by the Bluez Bluetooth utilities. A Bluetooth device with an already-established trust relationship, or a local user registering a service record via a UNIX(r) socket or D-Bus interface, could cause a crash, or possibly execute arbitrary code with privileges of the hcid daemon.
(CVE-2008-2374)

Users of bluez-libs and bluez-utils are advised to upgrade to these updated packages, which contains a backported patch to correct this issue.

Missing length checks in bluez-libs could cause a buffer overflow in Bluetooth applications. Malicious bluetooth devices could potentially exploit that to execute arbitrary code (CVE-2008-2374).

Note: The source code of each application that uses vulnerable functions of bluez-libs needs to be adapted to actually fix the problem.

An input validation flaw was found in the Bluetooth Session Description Protocol (SDP) packet parser used in the Bluez bluetooth utilities. A bluetooth device with an already-trusted relationship, or a local user registering a service record via a UNIX socket or D-Bus interface, could cause a crash and potentially execute arbitrary code with the privileges of the hcid daemon (CVE-2008-2374).

The updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200903-29 (BlueZ: Arbitrary code execution)

    It has been reported that the Bluetooth packet parser does not validate     string length fields in SDP packets.
  Impact :

    A physically proximate attacker using a Bluetooth device with an     already established trust relationship could send specially crafted     requests, possibly leading to arbitrary code execution or a crash.
    Exploitation may also be triggered by a local attacker registering a     service record via a UNIX socket or D-Bus interface.
  Workaround :

    There is no known workaround at this time.

The remote Fedora host is missing one or more security updates :

bluez-utils-3.35-3.fc8 :

  - Thu Jul 10 2008 - Will Woods <wwoods at redhat.com> -     3.35-3

    - Re-add hid2hci

    - Fri Jul 4 2008 - Bastien Nocera <bnocera at       redhat.com> - 3.35-2

    - Re-add hidd

    - Thu Jul 3 2008 - Bastien Nocera <bnocera at       redhat.com> - 3.35-1

    - Update to 3.35

    - Fri Jun 27 2008 - Bastien Nocera <bnocera at       redhat.com> - 3.34-1

    - Update to 3.34

    - Wed Mar 26 2008 - Bastien Nocera <bnocera at       redhat.com> - 3.20-7

    - Add patch to avoid a kernel oops when switching from       HID to HCI mode (#228755)

  - Fri Jan 25 2008 - Bastien Nocera <bnocera at redhat.com>
    - 3.20-6

    - Avoid dund and pand starting too early (#429489)

    - Fri Jan 25 2008 - Bastien Nocera <bnocera at       redhat.com> - 3.20-5

    - Fix hcid trying to find the OUI file somewhere in /var       (#428803)

bluez-libs-3.35-1.fc8 :

  - Thu Jul 3 2008 - Bastien Nocera <bnocera at redhat.com>
    - 3.35-1

    - Update to 3.35

    - Fri Jun 27 2008 - Bastien Nocera <bnocera at       redhat.com> - 3.34-1

    - Update to 3.34

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Missing length checks in bluez-libs could cause a buffer overflow in Bluetooth applications. Malicious bluetooth devices could potentially exploit that to execute arbitrary code. (CVE-2008-2374)

Note: The source code of each application that uses vulnerable functions of bluez-libs needs to be adapted to actually fix the problem.

The remote Fedora host is missing one or more security updates :

bluez-utils-3.35-3.fc9 :

  - Thu Jul 10 2008 - Will Woods <wwoods at redhat.com> -     3.35-3

    - Re-add hid2hci

    - Fri Jul 4 2008 - Bastien Nocera <bnocera at       redhat.com> - 3.35-2

    - Re-enable hidd

    - Thu Jul 3 2008 - Bastien Nocera <bnocera at       redhat.com> - 3.35-1

    - Update to 3.35

    - Fri Jun 27 2008 - Bastien Nocera <bnocera at       redhat.com> - 3.34-1

    - Update to 3.34

    - Thu Jun 12 2008 - Bastien Nocera <bnocera at       redhat.com> - 3.32-1

    - Update to 3.32

bluez-libs-3.35-1.fc9 :

  - Thu Jul 3 2008 - Bastien Nocera <bnocera at redhat.com>
    - 3.35-1

    - Update to 3.35

    - Fri Jun 27 2008 - Bastien Nocera <bnocera at       redhat.com> - 3.34-1

    - Update to 3.34

    - Thu Jun 12 2008 - Bastien Nocera <bnocera at       redhat.com> - 3.32-1

    - Update to 3.32

    - Fri Apr 18 2008 Peter Jones <pjones at redhat.com>

    - Make bluez-libs-devel own /usr/include/bluetooth/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67723	Oracle Linux 5 : bluez-libs / and / bluez-utils (ELSA-2008-0581)	Nessus	Oracle Linux Local Security Checks	critical
60439	Scientific Linux Security Update : bluez-libs and bluez-utils on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43698	CentOS 4 / 5 : bluez-libs / bluez-utils (CESA-2008:0581)	Nessus	CentOS Local Security Checks	high
39922	openSUSE Security Update : bluez-audio (bluez-audio-100)	Nessus	SuSE Local Security Checks	high
37587	Mandriva Linux Security Advisory : bluez (MDVSA-2008:145)	Nessus	Mandriva Local Security Checks	high
35942	GLSA-200903-29 : BlueZ: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
34421	Fedora 8 : bluez-libs-3.35-1.fc8 / bluez-utils-3.35-3.fc8 (2008-6140)	Nessus	Fedora Local Security Checks	high
34289	openSUSE 10 Security Update : bluez-audio (bluez-audio-5441)	Nessus	SuSE Local Security Checks	high
34276	SuSE 10 Security Update : Bluetooth utilities (ZYPP Patch Number 5437)	Nessus	SuSE Local Security Checks	high
34124	Fedora 9 : bluez-libs-3.35-1.fc9 / bluez-utils-3.35-3.fc9 (2008-6133)	Nessus	Fedora Local Security Checks	high
33497	RHEL 4 / 5 : bluez-libs and bluez-utils (RHSA-2008:0581)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2008-2374

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high