In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - bluez: Buffer overflow in parse_line function (CVE-2016-7837)

  - In BlueZ 5.42, a buffer over-read was observed in l2cap_dump function in tools/parser/l2cap.c source     file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
    (CVE-2016-9797)

  - In BlueZ 5.42, a use-after-free was identified in conf_opt function in tools/parser/l2cap.c source     file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
    (CVE-2016-9798)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - bluez: Buffer overflow in parse_line function (CVE-2016-7837)

  - In BlueZ 5.42, a buffer over-read was observed in l2cap_dump function in tools/parser/l2cap.c source     file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
    (CVE-2016-9797)

  - In BlueZ 5.42, a use-after-free was identified in conf_opt function in tools/parser/l2cap.c source     file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
    (CVE-2016-9798)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - bluez: heap-based buffer overflow via crafted request (CVE-2019-8922)

  - Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line     function used in some userland utilities. (CVE-2016-7837)

  - In BlueZ 5.42, a buffer over-read was observed in l2cap_dump function in tools/parser/l2cap.c source     file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
    (CVE-2016-9797)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the bluez package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In BlueZ 5.42, a use-after-free was identified in     'conf_opt' function in 'tools/parser/l2cap.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in hcidump     crash.(CVE-2016-9798)

  - In BlueZ 5.42, a buffer overflow was observed in     'pin_code_reply_dump' function in 'tools/parser/hci.c'     source file. The issue exists because 'pin' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'pin_code_reply_cp *cp' parameter.(CVE-2016-9800)

  - In BlueZ 5.42, a buffer overflow was observed in     'set_ext_ctrl' function in 'tools/parser/l2cap.c'     source file when processing corrupted dump     file.(CVE-2016-9801)

  - In BlueZ 5.42, a buffer over-read was identified in     'l2cap_packet' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9802)

  - In BlueZ 5.42, a buffer overflow was observed in     'commands_dump' function in 'tools/parser/csr.c' source     file. The issue exists because 'commands' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'frm->ptr' parameter. This issue can be triggered by     processing a corrupted dump file and will result in     hcidump crash.(CVE-2016-9804)

  - In BlueZ 5.42, a buffer overflow was observed in     'read_n' function in 'tools/hcidump.c' source file.
    This issue can be triggered by processing a corrupted     dump file and will result in hcidump     crash.(CVE-2016-9917)

  - In BlueZ 5.42, an out-of-bounds read was identified in     'packet_hexdump' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In BlueZ 5.42, an out-of-bounds read was identified in     'packet_hexdump' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9918)

  - In BlueZ 5.42, a buffer overflow was observed in     'read_n' function in 'tools/hcidump.c' source file.
    This issue can be triggered by processing a corrupted     dump file and will result in hcidump     crash.(CVE-2016-9917)

  - In BlueZ 5.42, a buffer overflow was observed in     'commands_dump' function in 'tools/parser/csr.c' source     file. The issue exists because 'commands' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'frm->ptr' parameter. This issue can be triggered by     processing a corrupted dump file and will result in     hcidump crash.(CVE-2016-9804)

  - In BlueZ 5.42, a buffer over-read was identified in     'l2cap_packet' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9802)

  - In BlueZ 5.42, a buffer overflow was observed in     'set_ext_ctrl' function in 'tools/parser/l2cap.c'     source file when processing corrupted dump     file.(CVE-2016-9801)

  - In BlueZ 5.42, a buffer overflow was observed in     'pin_code_reply_dump' function in 'tools/parser/hci.c'     source file. The issue exists because 'pin' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'pin_code_reply_cp *cp' parameter.(CVE-2016-9800)

  - In BlueZ 5.42, a use-after-free was identified in     'conf_opt' function in 'tools/parser/l2cap.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in hcidump     crash.(CVE-2016-9798)

  - In BlueZ before 5.55, a double free was found in the     gatttool disconnect_cb() routine from shared/att.c. A     remote attacker could potentially cause a denial of     service or code execution, during service discovery,     due to a redundant disconnect MGMT     event.(CVE-2020-27153)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In BlueZ 5.42, a use-after-free was identified in     'conf_opt' function in 'tools/parser/l2cap.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in hcidump     crash.(CVE-2016-9798)

  - In BlueZ 5.42, a buffer overflow was observed in     'pin_code_reply_dump' function in 'tools/parser/hci.c'     source file. The issue exists because 'pin' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'pin_code_reply_cp *cp' parameter.(CVE-2016-9800)

  - In BlueZ 5.42, a buffer overflow was observed in     'set_ext_ctrl' function in 'tools/parser/l2cap.c'     source file when processing corrupted dump     file.(CVE-2016-9801)

  - In BlueZ 5.42, a buffer over-read was identified in     'l2cap_packet' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9802)

  - In BlueZ 5.42, a buffer overflow was observed in     'commands_dump' function in 'tools/parser/csr.c' source     file. The issue exists because 'commands' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'frm->ptr' parameter. This issue can be triggered by     processing a corrupted dump file and will result in     hcidump crash.(CVE-2016-9804)

  - In BlueZ 5.42, a buffer overflow was observed in     'read_n' function in 'tools/hcidump.c' source file.
    This issue can be triggered by processing a corrupted     dump file and will result in hcidump     crash.(CVE-2016-9917)

  - In BlueZ 5.42, an out-of-bounds read was identified in     'packet_hexdump' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In BlueZ 5.42, a use-after-free was identified in     'conf_opt' function in 'tools/parser/l2cap.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in hcidump     crash.(CVE-2016-9798)

  - In BlueZ 5.42, a buffer overflow was observed in     'pin_code_reply_dump' function in 'tools/parser/hci.c'     source file. The issue exists because 'pin' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'pin_code_reply_cp *cp' parameter.(CVE-2016-9800)

  - In BlueZ 5.42, a buffer overflow was observed in     'set_ext_ctrl' function in 'tools/parser/l2cap.c'     source file when processing corrupted dump     file.(CVE-2016-9801)

  - In BlueZ 5.42, a buffer over-read was identified in     'l2cap_packet' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9802)

  - In BlueZ 5.42, a buffer overflow was observed in     'commands_dump' function in 'tools/parser/csr.c' source     file. The issue exists because 'commands' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'frm->ptr' parameter. This issue can be triggered by     processing a corrupted dump file and will result in     hcidump crash.(CVE-2016-9804)

  - In BlueZ 5.42, a buffer overflow was observed in     'read_n' function in 'tools/hcidump.c' source file.
    This issue can be triggered by processing a corrupted     dump file and will result in hcidump     crash.(CVE-2016-9917)

  - In BlueZ 5.42, an out-of-bounds read was identified in     'packet_hexdump' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In BlueZ 5.42, a buffer overflow was observed in     'commands_dump' function in 'tools/parser/csr.c' source     file. The issue exists because 'commands' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'frm->ptr' parameter. This issue can be triggered by     processing a corrupted dump file and will result in     hcidump crash.(CVE-2016-9804)

  - In BlueZ 5.42, a buffer overflow was observed in     'pin_code_reply_dump' function in 'tools/parser/hci.c'     source file. The issue exists because 'pin' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'pin_code_reply_cp *cp' parameter.(CVE-2016-9800)

  - In BlueZ 5.42, a buffer overflow was observed in     'read_n' function in 'tools/hcidump.c' source file.
    This issue can be triggered by processing a corrupted     dump file and will result in hcidump     crash.(CVE-2016-9917)

  - In BlueZ 5.42, a buffer overflow was observed in     'set_ext_ctrl' function in 'tools/parser/l2cap.c'     source file when processing corrupted dump     file.(CVE-2016-9801)

  - In BlueZ 5.42, a buffer over-read was identified in     'l2cap_packet' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9802)

  - In BlueZ 5.42, a use-after-free was identified in     'conf_opt' function in 'tools/parser/l2cap.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in hcidump     crash.(CVE-2016-9798)

  - In BlueZ 5.42, an out-of-bounds read was identified in     'packet_hexdump' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bluez fixes the following issues :

Security issues fixed :

  - CVE-2016-9800: Fixed a buffer overflow in     pin_code_reply_dump function (bsc#1013721)

  - CVE-2016-9801: Fixed a buffer overflow in set_ext_ctrl     function (bsc#1013732)

This update was imported from the SUSE:SLE-15:Update update project.

This update for bluez fixes the following issues :

Security issues fixed :

CVE-2016-7837: Fixed possible buffer overflow, make sure we don't write past the end of the array.(bsc#1026652)

CVE-2016-9800: Fix hcidump memory leak in pin_code_reply_dump() (bsc#1013721).

CVE-2016-9801: Fixed a buffer overflow in set_ext_ctrl function (bsc#1013732)

CVE-2016-9804: Fix hcidump buffer overflow in commands_dump() (bsc#1013877).

CVE-2016-9918: Fixed an out-of-bounds read in packet_hexdump() (bsc#1015173)

CVE-2017-1000250: Fixed a information leak in SDP (part of the recently published BlueBorne vulnerabilities) (bsc#1057342)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bluez fixes the following issues :

Security issues fixed :

CVE-2016-9800: Fixed a buffer overflow in pin_code_reply_dump function (bsc#1013721)

CVE-2016-9801: Fixed a buffer overflow in set_ext_ctrl function (bsc#1013732)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bluez fixes the following issues :

Security issues fixed :

CVE-2016-9800: Fixed a buffer overflow in the pin_code_reply_dump function (bsc#1013721)

CVE-2016-9801: Fixed a buffer overflow in the set_ext_ctrl function (bsc#1013732)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198724	RHEL 5 : bluez (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198719	RHEL 6 : bluez (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198714	RHEL 7 : bluez (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
151392	EulerOS Virtualization 3.0.2.2 : bluez (EulerOS-SA-2021-2129)	Nessus	Huawei Local Security Checks	high
151295	EulerOS Virtualization for ARM 64 3.0.2.0 : bluez (EulerOS-SA-2021-2088)	Nessus	Huawei Local Security Checks	high
147616	EulerOS Virtualization 3.0.6.6 : bluez (EulerOS-SA-2021-1460)	Nessus	Huawei Local Security Checks	high
147516	EulerOS Virtualization 3.0.2.6 : bluez (EulerOS-SA-2021-1427)	Nessus	Huawei Local Security Checks	high
146182	EulerOS 2.0 SP5 : bluez (EulerOS-SA-2021-1179)	Nessus	Huawei Local Security Checks	high
132276	EulerOS 2.0 SP3 : bluez (EulerOS-SA-2019-2559)	Nessus	Huawei Local Security Checks	high
131872	EulerOS 2.0 SP2 : bluez (EulerOS-SA-2019-2380)	Nessus	Huawei Local Security Checks	high
123160	openSUSE Security Update : bluez (openSUSE-2019-1030)	Nessus	SuSE Local Security Checks	medium
122530	SUSE SLES12 Security Update : bluez (SUSE-SU-2019:0510-1) (BlueBorne)	Nessus	SuSE Local Security Checks	high
120190	SUSE SLED15 / SLES15 Security Update : bluez (SUSE-SU-2018:4189-1)	Nessus	SuSE Local Security Checks	medium
119864	openSUSE Security Update : bluez (openSUSE-2018-1596)	Nessus	SuSE Local Security Checks	medium
119806	SUSE SLED12 / SLES12 Security Update : bluez (SUSE-SU-2018:4188-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2016-9801

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

medium

high

medium

medium

medium