The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset' variable before using it as an index into an array for reading.

The remote host is affected by the vulnerability described in GLSA-202209-16 (BlueZ: Multiple Vulnerabilities)

  - Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby     man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication     procedure) by reflection of the public key and the authentication evidence of the initiating device,     potentially permitting this attacker to complete authenticated pairing with the responding device using     the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit     at a time. (CVE-2020-26558)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset'     variable before using it as an index into an array for reading. (CVE-2021-3588)

  - A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network     access could pass specially crafted files causing an application to halt or crash, leading to a denial of     service. (CVE-2022-0204)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2459-1 advisory.

  - The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset'     variable before using it as an index into an array for reading. (CVE-2021-3588)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2459-1 advisory.

  - The cli_feat_read_cb() function in src/gatt-database.c does not perform bounds checks on the 'offset'     variable before using it as an index into an array for reading. (CVE-2021-3588)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4989-1 advisory.

    It was discovered that BlueZ incorrectly checked certain permissions when pairing. A local attacker could     possibly use this issue to impersonate devices. (CVE-2020-26558)

    Jay LV discovered that BlueZ incorrectly handled redundant disconnect MGMT events. A local attacker could     use this issue to cause BlueZ to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-27153)

    Ziming Zhang discovered that BlueZ incorrectly handled certain array indexes. A local attacker could use     this issue to cause BlueZ to crash, resulting in a denial of service, or possibly obtain sensitive     information. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-3588)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
165542	GLSA-202209-16 : BlueZ: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
152031	SUSE SLED15 / SLES15 Security Update : bluez (SUSE-SU-2021:2459-1)	Nessus	SuSE Local Security Checks	low
152007	openSUSE 15 Security Update : bluez (openSUSE-SU-2021:2459-1)	Nessus	SuSE Local Security Checks	low
150809	Ubuntu 18.04 LTS / 20.04 LTS : BlueZ vulnerabilities (USN-4989-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2021-3588

low

Tenable Plugins

high

low

low

high