All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - bluez: Out-of-bounds heap read in service_search_attr_req function (CVE-2017-1000250)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote NewStart CGSL host, running version MAIN 4.05, has bluez packages installed that are affected by a vulnerability:

  - An information-disclosure flaw was found in the     bluetoothd implementation of the Service Discovery     Protocol (SDP). A specially crafted Bluetooth device     could, without prior pairing or user interaction,     retrieve portions of the bluetoothd process memory,     including potentially sensitive information such as     Bluetooth encryption keys. (CVE-2017-1000250)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the bluez package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - An information-disclosure flaw was found in the     bluetoothd implementation of the Service Discovery     Protocol (SDP). A specially crafted Bluetooth device     could, without prior pairing or user interaction,     retrieve portions of the bluetoothd process memory,     including potentially sensitive information such as     Bluetooth encryption keys.(CVE-2017-1000250)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bluez fixes the following issues :

Security issues fixed :

CVE-2016-7837: Fixed possible buffer overflow, make sure we don't write past the end of the array.(bsc#1026652)

CVE-2016-9800: Fix hcidump memory leak in pin_code_reply_dump() (bsc#1013721).

CVE-2016-9801: Fixed a buffer overflow in set_ext_ctrl function (bsc#1013732)

CVE-2016-9804: Fix hcidump buffer overflow in commands_dump() (bsc#1013877).

CVE-2016-9918: Fixed an out-of-bounds read in packet_hexdump() (bsc#1015173)

CVE-2017-1000250: Fixed a information leak in SDP (part of the recently published BlueBorne vulnerabilities) (bsc#1057342)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for bluez is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (Red Hat), and pcmcia configuration files.

Security Fix(es) :

* An information-disclosure flaw was found in the bluetoothd implementation of the Service Discovery Protocol (SDP). A specially crafted Bluetooth device could, without prior pairing or user interaction, retrieve portions of the bluetoothd process memory, including potentially sensitive information such as Bluetooth encryption keys. (CVE-2017-1000250)

Red Hat would like to thank Armis Labs for reporting this issue.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bluez fixes the following issues: Security issues fixed :

  - CVE-2016-9800: Fix hcidump memory leak in     pin_code_reply_dump() (bsc#1013721).

  - CVE-2016-9804: Fix hcidump buffer overflow in     commands_dump() (bsc#1013877).

  - CVE-2016-7837: Fix possible buffer overflow, make sure     we don't write past the end of the array (bsc#1026652).

  - CVE-2017-1000250: Fix information disclosure     vulnerability in service_search_attr_req (bsc#1057342).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-1000250

----

  - This update adds support for cable pairing for     PlayStation 3 and 4 controllers.

  - Add scripts to automatically btattach serial-port / uart     connected Broadcom HCIs found on some Atom based x86     hardware

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bluez fixes the following vulnerabilities :

  - CVE-2016-7837: Buffer overflow in parse_line function     (bsc#1026652)

  - CVE-2017-1000250: information disclosure vulnerability     in service_search_attr_req (bsc#1057342)

The SDP server in BlueZ is vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.

For Debian 7 'Wheezy', these problems have been fixed in version 4.99-2+deb7u1.

We recommend that you upgrade your bluez packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New bluez packages are available for Slackware 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue.

Security fix for CVE-2017-1000250

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An information disclosure vulnerability was discovered in the Service Discovery Protocol (SDP) in bluetoothd, allowing a proximate attacker to obtain sensitive information from bluetoothd process memory, including Bluetooth encryption keys.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3413-1 advisory.

    It was discovered that an information disclosure vulnerability existed in the Service Discovery Protocol     (SDP) implementation in BlueZ. A physically proximate unauthenticated attacker could use this to disclose     sensitive information. (CVE-2017-1000250)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - An information-disclosure flaw was found in the     bluetoothd implementation of the Service Discovery     Protocol (SDP). A specially crafted Bluetooth device     could, without prior pairing or user interaction,     retrieve portions of the bluetoothd process memory,     including potentially sensitive information such as     Bluetooth encryption keys. (CVE-2017-1000250)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2685 advisory.

    The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach,     hciconfig, bluetoothd, l2ping, start scripts (Red Hat), and pcmcia configuration files.

    Security Fix(es):

    * An information-disclosure flaw was found in the bluetoothd implementation of the Service Discovery     Protocol (SDP). A specially crafted Bluetooth device could, without prior pairing or user interaction,     retrieve portions of the bluetoothd process memory, including potentially sensitive information such as     Bluetooth encryption keys. (CVE-2017-1000250)

    Red Hat would like to thank Armis Labs for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2685 advisory.

    [4.66-2]
    - sdpd heap fixes     Resolves: #1490008

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for bluez is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (Red Hat), and pcmcia configuration files.

Security Fix(es) :

* An information-disclosure flaw was found in the bluetoothd implementation of the Service Discovery Protocol (SDP). A specially crafted Bluetooth device could, without prior pairing or user interaction, retrieve portions of the bluetoothd process memory, including potentially sensitive information such as Bluetooth encryption keys. (CVE-2017-1000250)

Red Hat would like to thank Armis Labs for reporting this issue.

ID	Name	Product	Family	Severity
199857	RHEL 5 : bluez-utils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196425	RHEL 5 : bluez (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
127358	NewStart CGSL MAIN 4.05 : bluez Vulnerability (NS-SA-2019-0117)	Nessus	NewStart CGSL Local Security Checks	medium
124881	EulerOS Virtualization for ARM 64 3.0.1.0 : bluez (EulerOS-SA-2019-1378)	Nessus	Huawei Local Security Checks	medium
122530	SUSE SLES12 Security Update : bluez (SUSE-SU-2019:0510-1) (BlueBorne)	Nessus	SuSE Local Security Checks	high
119224	Virtuozzo 6 : bluez / bluez-alsa / bluez-compat / bluez-cups / etc (VZLSA-2017-2685)	Nessus	Virtuozzo Local Security Checks	medium
110661	SUSE SLED12 / SLES12 Security Update : bluez (SUSE-SU-2018:1778-1) (BlueBorne)	Nessus	SuSE Local Security Checks	high
105904	Fedora 27 : bluez (2017-77f991e537) (BlueBorne)	Nessus	Fedora Local Security Checks	medium
104080	openSUSE Security Update : bluez (openSUSE-2017-1176) (BlueBorne)	Nessus	SuSE Local Security Checks	high
103390	Debian DLA-1103-1 : bluez security update (BlueBorne)	Nessus	Debian Local Security Checks	medium
103255	Slackware 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : bluez (SSA:2017-258-01) (BlueBorne)	Nessus	Slackware Local Security Checks	medium
103202	Fedora 26 : bluez (2017-fe95a5b88b) (BlueBorne)	Nessus	Fedora Local Security Checks	medium
103198	Debian DSA-3972-1 : bluez - security update (BlueBorne)	Nessus	Debian Local Security Checks	medium
103187	Ubuntu 14.04 LTS / 16.04 LTS : BlueZ vulnerability (USN-3413-1)	Nessus	Ubuntu Local Security Checks	medium
103173	Scientific Linux Security Update : bluez on SL6.x, SL7.x i386/x86_64 (20170912) (BlueBorne)	Nessus	Scientific Linux Local Security Checks	medium
103172	RHEL 6 / 7 : bluez (RHSA-2017:2685)	Nessus	Red Hat Local Security Checks	medium
103166	Oracle Linux 6 / 7 : bluez (ELSA-2017-2685)	Nessus	Oracle Linux Local Security Checks	medium
103145	CentOS 6 / 7 : bluez (CESA-2017:2685) (BlueBorne)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2017-1000250

medium

Tenable Plugins

medium

high

medium

medium

high

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium