SB2017091502 - Information disclosure in Red Hat Enterprise Linux
Published: September 15, 2017
Security Bulletin ID
SB2017091502
Severity
Low
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Out-of-bounds read (CVE-ID: CVE-2017-1000250)
The vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.The weakness exists in the bluetoothd implementation of the Service Discovery Protocol (SDP) due to out-of-bounds heap read condition in the service_search_attr_req function. An adjacent attacker send specially crafted requests that has Bluetooth enabled in the SDP server and access sensitive information, such as encryption keys, from bluetoothd process memory.
Successful exploitation of the vulnerability results in information disclosure.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.