BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and invalid capabilities can be processed in profiles/audio/avdtp.c.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3879 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3879-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     September 07, 2024                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : bluez     Version        : 5.55-3.1+deb11u2     CVE ID         : CVE-2021-3658 CVE-2021-41229 CVE-2021-43400 CVE-2022-0204                      CVE-2022-39176 CVE-2022-39177 CVE-2023-27349 CVE-2023-50229                      CVE-2023-50230     Debian Bug     : 991596 998626 1000262 1003712

    Multiple vulnerabilities have been fixed in bluez library, tools and     daemons for using Bluetooth devices.

    CVE-2021-3658

        adapter: Fix storing discoverable setting

    CVE-2021-41229

        Memory leak in the SDP protocol

    CVE-2021-43400

        Use-after-free on client disconnect

    CVE-2022-0204

        GATT heap overflow

    CVE-2022-39176

        Proximate attackers could obtain sensitive information

    CVE-2022-39177

        Proximate attackers could cause denial of service

    CVE-2023-27349

        AVRCP crash while handling unsupported events

    CVE-2023-50229

        Phone Book Access profile Heap-based Buffer Overflow

    CVE-2023-50230

        Phone Book Access profile Heap-based Buffer Overflow

    For Debian 11 bullseye, these problems have been fixed in version     5.55-3.1+deb11u2.

    We recommend that you upgrade your bluez packages.

    For the detailed security status of bluez please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/bluez

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the bluez package has been released.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: Authvalue leak in Bluetooth Mesh Provisioning (CVE-2020-26559)

  - bluez: BlueZ allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c (CVE-2022-39177)

  - Pairing in Bluetooth Core v5.2 and earlier may permit an unauthenticated attacker to acquire credentials     with two pairing devices via adjacent access when the unauthenticated user initiates different pairing     methods in each peer device and an end-user erroneously completes both pairing procedures with the MITM     using the confirmation number of one peer as the passkey of the other. An adjacent, unauthenticated     attacker could be able to initiate any Bluetooth operation on either attacked device exposed by the     enabled Bluetooth profiles. This exposure may be limited when the user must authorize certain access     explicitly, but so long as a user assumes that it is the intended remote device requesting permissions,     device-local protections may be weakened. (CVE-2020-10134)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: impersonation attack in Bluetooth Mesh Provisioning (CVE-2020-26560)

  - bluez: BlueZ allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c (CVE-2022-39177)

  - A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function     read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation     of the argument cap_len leads to null pointer dereference. It is recommended to apply a patch to fix this     issue. VDB-211086 is the identifier assigned to this vulnerability. (CVE-2022-3563)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the bluez packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

  - A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network     access could pass specially crafted files causing an application to halt or crash, leading to a denial of     service. (CVE-2022-0204)

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0156-1 advisory.

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0166-1 advisory.

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0168-1 advisory.

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0155-1 advisory.

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of bluez installed on the remote host is prior to 5.44-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1881 advisory.

    2023-06-07: CVE-2022-39177 was added to this advisory.

    A vulnerability was found in BlueZ. This flaw allows physically proximate attackers to cause a denial of     service due to malformed and invalid capabilities processed in profiles/audio/avdtp.c. (CVE-2022-39177)

    A vulnerability was found in BlueZ. This flaw allows physically proximate attackers to obtain sensitive     information because the profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3157 advisory.

  - An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a     SVC_ATTR_REQ by the SDP implementation. By crafting a malicious CSTATE, it is possible to trick the server     into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data. The     root cause can be found in the function service_attr_req of sdpd-request.c. The server does not check     whether the CSTATE data is the same in consecutive requests, and instead simply trusts that it is the     same. (CVE-2019-8921)

  - A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on     whether there is enough space in the destination buffer. The function simply appends all data passed to     it. The values of all attributes that are requested are appended to the output buffer. There are no size     checks whatsoever, resulting in a simple heap overflow if one can craft a request where the response is     large enough to overflow the preallocated buffer. This issue exists in service_attr_req gets called by     process_request (in sdpd-request.c), which also allocates the response buffer. (CVE-2019-8922)

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

  - An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client     disconnects during D-Bus processing of a WriteValue call. (CVE-2021-43400)

  - A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network     access could pass specially crafted files causing an application to halt or crash, leading to a denial of     service. (CVE-2022-0204)

  - BlueZ before 5.59 allows physically proximate attackers to obtain sensitive information because     profiles/audio/avrcp.c does not validate params_len. (CVE-2022-39176)

  - BlueZ before 5.59 allows physically proximate attackers to cause a denial of service because malformed and     invalid capabilities can be processed in profiles/audio/avdtp.c. (CVE-2022-39177)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
206762	Debian dla-3879 : bluetooth - security update	Nessus	Debian Local Security Checks	critical
204625	Photon OS 3.0: Bluez PHSA-2022-3.0-0453	Nessus	PhotonOS Local Security Checks	high
203333	Photon OS 4.0: Bluez PHSA-2022-4.0-0245	Nessus	PhotonOS Local Security Checks	high
198738	RHEL 8 : bluez (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198717	RHEL 9 : bluez (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196471	RHEL 6 : bluez (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
178895	EulerOS Virtualization 3.0.6.6 : bluez (EulerOS-SA-2023-2406)	Nessus	Huawei Local Security Checks	high
175202	EulerOS Virtualization 3.0.2.0 : bluez (EulerOS-SA-2023-1742)	Nessus	Huawei Local Security Checks	high
172279	EulerOS 2.0 SP5 : bluez (EulerOS-SA-2023-1491)	Nessus	Huawei Local Security Checks	high
170721	SUSE SLES15 Security Update : bluez (SUSE-SU-2023:0156-1)	Nessus	SuSE Local Security Checks	high
170720	SUSE SLED12 / SLES12 Security Update : bluez (SUSE-SU-2023:0166-1)	Nessus	SuSE Local Security Checks	high
170716	SUSE SLES15 Security Update : bluez (SUSE-SU-2023:0168-1)	Nessus	SuSE Local Security Checks	high
170710	SUSE SLES15 Security Update : bluez (SUSE-SU-2023:0155-1)	Nessus	SuSE Local Security Checks	high
168444	Amazon Linux 2 : bluez (ALAS-2022-1881)	Nessus	Amazon Linux Local Security Checks	high
166429	Debian DLA-3157-1 : bluez - LTS security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2022-39177

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

critical