Detections
Analytics

RHEL 4 / 5 : bluez-libs and bluez-utils (RHSA-2008:0581)

high Nessus Plugin ID 33497

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated bluez-libs and bluez-utils packages that fix a security flaw are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The bluez-libs package contains libraries for use in Bluetooth applications. The bluez-utils package contains Bluetooth daemons and utilities.

An input validation flaw was found in the Bluetooth Session Description Protocol (SDP) packet parser used by the Bluez Bluetooth utilities. A Bluetooth device with an already-established trust relationship, or a local user registering a service record via a UNIX(r) socket or D-Bus interface, could cause a crash, or possibly execute arbitrary code with privileges of the hcid daemon.
(CVE-2008-2374)

Users of bluez-libs and bluez-utils are advised to upgrade to these updated packages, which contains a backported patch to correct this issue.

Solution

Update the affected packages.

See Also

https://access.redhat.com/security/cve/cve-2008-2374

https://access.redhat.com/errata/RHSA-2008:0581

Plugin Details

Severity: High

ID: 33497

File Name: redhat-RHSA-2008-0581.nasl

Version: 1.27

Type: local

Agent: unix

Published: 7/15/2008

Updated: 1/14/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:bluez-libs, cpe:/o:redhat:enterprise_linux:5, p-cpe:/a:redhat:enterprise_linux:bluez-utils-cups, p-cpe:/a:redhat:enterprise_linux:bluez-utils, cpe:/o:redhat:enterprise_linux:4, cpe:/o:redhat:enterprise_linux:4.6, cpe:/o:redhat:enterprise_linux:5.2, p-cpe:/a:redhat:enterprise_linux:bluez-libs-devel

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 7/14/2008

Vulnerability Publication Date: 7/7/2008

Reference Information

CVE: CVE-2008-2374

BID: 30105

CWE: 20

RHSA: 2008:0581