SB2019012808 - Security restrictions bypass in Bluez

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019012808

SB2019012808 - Security restrictions bypass in Bluez

Published: January 28, 2019 Updated: December 2, 2019

Security Bulletin ID SB2019012808
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Physical access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2018-10910)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists in BlueZ due to an error that may allow an attacker to turn on the Bluetooth Discoverable state, when no Bluetooth agent is registered with the system. A remote attacker with physical proximity to the device can remotely turn on Bluetooth agent and access the device without authorization in some cases.


Remediation

Install update from vendor's website.

References