SUSE update for bluez



Risk Medium
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2019-8921
CVE-2019-8922
CVE-2020-26558
CVE-2021-0129
CVE-2021-3658
CVE-2021-43400
CWE-ID CWE-125
CWE-122
CWE-254
CWE-284
CWE-863
CWE-416
Exploitation vector Local network
Public exploit N/A
Vulnerable software
 SUSE Linux Enterprise Server for SAP
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing
Operating systems & Components / Operating system

SUSE Enterprise Storage
Operating systems & Components / Operating system

SUSE CaaS Platform
Operating systems & Components / Operating system

SUSE Linux Enterprise Server
Operating systems & Components / Operating system

libbluetooth3-debuginfo
Operating systems & Components / Operating system package or component

libbluetooth3
Operating systems & Components / Operating system package or component

bluez-devel
Operating systems & Components / Operating system package or component

bluez-debugsource
Operating systems & Components / Operating system package or component

bluez-debuginfo
Operating systems & Components / Operating system package or component

bluez
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU68830

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-8921

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to missing verification checks when handling consecutive SVC_ATTR_REQ requests within the service_attr_req() function in sdpd-request.c in bluetoothd . A remote attacker on the local network can send specially crafted CSTATE data to the system and trick the server into returning more bytes than the buffer actually holds, resulting in leaking arbitrary heap data.

Mitigation

Update the affected package bluez to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-LTSS - 15-SP1-LTSS

libbluetooth3-debuginfo: before 5.48-150000.5.41.1

libbluetooth3: before 5.48-150000.5.41.1

bluez-devel: before 5.48-150000.5.41.1

bluez-debugsource: before 5.48-150000.5.41.1

bluez-debuginfo: before 5.48-150000.5.41.1

bluez: before 5.48-150000.5.41.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-20223687-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-based buffer overflow

EUVDB-ID: #VU66694

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-8922

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within bluetoothd. A remote attacker on the local network can send specially crafted data to the system, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package bluez to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-LTSS - 15-SP1-LTSS

libbluetooth3-debuginfo: before 5.48-150000.5.41.1

libbluetooth3: before 5.48-150000.5.41.1

bluez-devel: before 5.48-150000.5.41.1

bluez-debugsource: before 5.48-150000.5.41.1

bluez-debuginfo: before 5.48-150000.5.41.1

bluez: before 5.48-150000.5.41.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-20223687-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Security features bypass

EUVDB-ID: #VU53579

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-26558

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to an impersonation in the Passkey Entry protocol flaw. A remote attacker on the local network can perform a man-in-the-middle (MITM) attack and impersonate the initiating device without any previous knowledge.

Note: This vulnerability affects the following specifications:

  • BR/EDR Secure Simple Pairing in Bluetooth Core Specifications 2.1 through 5.2
  • BR/EDR Secure Connections Pairing in Bluetooth Core Specifications 4.1 through 5.2 
  • LE Secure Connections Pairing in Bluetooth Core Specifications 4.2 through 5.2

Mitigation

Update the affected package bluez to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-LTSS - 15-SP1-LTSS

libbluetooth3-debuginfo: before 5.48-150000.5.41.1

libbluetooth3: before 5.48-150000.5.41.1

bluez-devel: before 5.48-150000.5.41.1

bluez-debugsource: before 5.48-150000.5.41.1

bluez-debuginfo: before 5.48-150000.5.41.1

bluez: before 5.48-150000.5.41.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-20223687-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU54202

Risk: Low

CVSSv4.0: 4.5 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-0129

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote authenticated attacker on the local network can bypass implemented security restrictions and enable information disclosure

Mitigation

Update the affected package bluez to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-LTSS - 15-SP1-LTSS

libbluetooth3-debuginfo: before 5.48-150000.5.41.1

libbluetooth3: before 5.48-150000.5.41.1

bluez-devel: before 5.48-150000.5.41.1

bluez-debugsource: before 5.48-150000.5.41.1

bluez-debuginfo: before 5.48-150000.5.41.1

bluez: before 5.48-150000.5.41.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-20223687-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Incorrect authorization

EUVDB-ID: #VU83408

Risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3658

CWE-ID: CWE-863 - Incorrect Authorization

Exploit availability: No

Description

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to bluetoothd incorrectly saves the adapters' discoverable status when a device is powered down, and restores it when powered up. An attacker with physical proximity to device can gain access to sensitive information.

Mitigation

Update the affected package bluez to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-LTSS - 15-SP1-LTSS

libbluetooth3-debuginfo: before 5.48-150000.5.41.1

libbluetooth3: before 5.48-150000.5.41.1

bluez-devel: before 5.48-150000.5.41.1

bluez-debugsource: before 5.48-150000.5.41.1

bluez-debuginfo: before 5.48-150000.5.41.1

bluez: before 5.48-150000.5.41.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-20223687-1/


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU83407

Risk: Medium

CVSSv4.0: 3.7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-43400

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows an attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in gatt-database.c on a gatt server if a client disconnects while a WriteValue call is being processed with D-Bus. An attacker with physical proximity to the system can trigger a use-after-free error and potentially execute arbitrary code.

Mitigation

Update the affected package bluez to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP1-LTSS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-LTSS - 15-SP1-LTSS

libbluetooth3-debuginfo: before 5.48-150000.5.41.1

libbluetooth3: before 5.48-150000.5.41.1

bluez-devel: before 5.48-150000.5.41.1

bluez-debugsource: before 5.48-150000.5.41.1

bluez-debuginfo: before 5.48-150000.5.41.1

bluez: before 5.48-150000.5.41.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2022/suse-su-20223687-1/


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###