In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' (which is used to read correct element from 'ev_le_meta_str' array) is overflowed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - bluez: Buffer overflow in parse_line function (CVE-2016-7837)

  - In BlueZ 5.42, a buffer over-read was observed in l2cap_dump function in tools/parser/l2cap.c source     file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
    (CVE-2016-9797)

  - In BlueZ 5.42, a use-after-free was identified in conf_opt function in tools/parser/l2cap.c source     file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
    (CVE-2016-9798)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - bluez: Buffer overflow in parse_line function (CVE-2016-7837)

  - In BlueZ 5.42, a buffer over-read was observed in l2cap_dump function in tools/parser/l2cap.c source     file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
    (CVE-2016-9797)

  - In BlueZ 5.42, a use-after-free was identified in conf_opt function in tools/parser/l2cap.c source     file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
    (CVE-2016-9798)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - bluez: heap-based buffer overflow via crafted request (CVE-2019-8922)

  - Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line     function used in some userland utilities. (CVE-2016-7837)

  - In BlueZ 5.42, a buffer over-read was observed in l2cap_dump function in tools/parser/l2cap.c source     file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.
    (CVE-2016-9797)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3718-1 advisory.

  - In BlueZ 5.42, an out-of-bounds read was observed in le_meta_ev_dump function in tools/parser/hci.c     source file. This issue exists because 'subevent' (which is used to read correct element from     'ev_le_meta_str' array) is overflowed. (CVE-2016-9803)

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198724	RHEL 5 : bluez (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198719	RHEL 6 : bluez (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198714	RHEL 7 : bluez (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196471	RHEL 6 : bluez (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196425	RHEL 5 : bluez (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
166534	SUSE SLED12 / SLES12 Security Update : bluez (SUSE-SU-2022:3718-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2016-9803

medium

Tenable Plugins

high

high

high

high

high

medium