In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exists because "commands" array is overflowed by supplied parameter due to lack of boundary checks on size of the buffer from frame "frm->ptr" parameter. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.

According to the versions of the bluez package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In BlueZ 5.42, a use-after-free was identified in     'conf_opt' function in 'tools/parser/l2cap.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in hcidump     crash.(CVE-2016-9798)

  - In BlueZ 5.42, a buffer overflow was observed in     'pin_code_reply_dump' function in 'tools/parser/hci.c'     source file. The issue exists because 'pin' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'pin_code_reply_cp *cp' parameter.(CVE-2016-9800)

  - In BlueZ 5.42, a buffer overflow was observed in     'set_ext_ctrl' function in 'tools/parser/l2cap.c'     source file when processing corrupted dump     file.(CVE-2016-9801)

  - In BlueZ 5.42, a buffer over-read was identified in     'l2cap_packet' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9802)

  - In BlueZ 5.42, a buffer overflow was observed in     'commands_dump' function in 'tools/parser/csr.c' source     file. The issue exists because 'commands' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'frm->ptr' parameter. This issue can be triggered by     processing a corrupted dump file and will result in     hcidump crash.(CVE-2016-9804)

  - In BlueZ 5.42, a buffer overflow was observed in     'read_n' function in 'tools/hcidump.c' source file.
    This issue can be triggered by processing a corrupted     dump file and will result in hcidump     crash.(CVE-2016-9917)

  - In BlueZ 5.42, an out-of-bounds read was identified in     'packet_hexdump' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In BlueZ 5.42, an out-of-bounds read was identified in     'packet_hexdump' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9918)

  - In BlueZ 5.42, a buffer overflow was observed in     'read_n' function in 'tools/hcidump.c' source file.
    This issue can be triggered by processing a corrupted     dump file and will result in hcidump     crash.(CVE-2016-9917)

  - In BlueZ 5.42, a buffer overflow was observed in     'commands_dump' function in 'tools/parser/csr.c' source     file. The issue exists because 'commands' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'frm->ptr' parameter. This issue can be triggered by     processing a corrupted dump file and will result in     hcidump crash.(CVE-2016-9804)

  - In BlueZ 5.42, a buffer over-read was identified in     'l2cap_packet' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9802)

  - In BlueZ 5.42, a buffer overflow was observed in     'set_ext_ctrl' function in 'tools/parser/l2cap.c'     source file when processing corrupted dump     file.(CVE-2016-9801)

  - In BlueZ 5.42, a buffer overflow was observed in     'pin_code_reply_dump' function in 'tools/parser/hci.c'     source file. The issue exists because 'pin' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'pin_code_reply_cp *cp' parameter.(CVE-2016-9800)

  - In BlueZ 5.42, a use-after-free was identified in     'conf_opt' function in 'tools/parser/l2cap.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in hcidump     crash.(CVE-2016-9798)

  - In BlueZ before 5.55, a double free was found in the     gatttool disconnect_cb() routine from shared/att.c. A     remote attacker could potentially cause a denial of     service or code execution, during service discovery,     due to a redundant disconnect MGMT     event.(CVE-2020-27153)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In BlueZ 5.42, a use-after-free was identified in     'conf_opt' function in 'tools/parser/l2cap.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in hcidump     crash.(CVE-2016-9798)

  - In BlueZ 5.42, a buffer overflow was observed in     'pin_code_reply_dump' function in 'tools/parser/hci.c'     source file. The issue exists because 'pin' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'pin_code_reply_cp *cp' parameter.(CVE-2016-9800)

  - In BlueZ 5.42, a buffer overflow was observed in     'set_ext_ctrl' function in 'tools/parser/l2cap.c'     source file when processing corrupted dump     file.(CVE-2016-9801)

  - In BlueZ 5.42, a buffer over-read was identified in     'l2cap_packet' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9802)

  - In BlueZ 5.42, a buffer overflow was observed in     'commands_dump' function in 'tools/parser/csr.c' source     file. The issue exists because 'commands' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'frm->ptr' parameter. This issue can be triggered by     processing a corrupted dump file and will result in     hcidump crash.(CVE-2016-9804)

  - In BlueZ 5.42, a buffer overflow was observed in     'read_n' function in 'tools/hcidump.c' source file.
    This issue can be triggered by processing a corrupted     dump file and will result in hcidump     crash.(CVE-2016-9917)

  - In BlueZ 5.42, an out-of-bounds read was identified in     'packet_hexdump' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In BlueZ 5.42, a use-after-free was identified in     'conf_opt' function in 'tools/parser/l2cap.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in hcidump     crash.(CVE-2016-9798)

  - In BlueZ 5.42, a buffer overflow was observed in     'pin_code_reply_dump' function in 'tools/parser/hci.c'     source file. The issue exists because 'pin' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'pin_code_reply_cp *cp' parameter.(CVE-2016-9800)

  - In BlueZ 5.42, a buffer overflow was observed in     'set_ext_ctrl' function in 'tools/parser/l2cap.c'     source file when processing corrupted dump     file.(CVE-2016-9801)

  - In BlueZ 5.42, a buffer over-read was identified in     'l2cap_packet' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9802)

  - In BlueZ 5.42, a buffer overflow was observed in     'commands_dump' function in 'tools/parser/csr.c' source     file. The issue exists because 'commands' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'frm->ptr' parameter. This issue can be triggered by     processing a corrupted dump file and will result in     hcidump crash.(CVE-2016-9804)

  - In BlueZ 5.42, a buffer overflow was observed in     'read_n' function in 'tools/hcidump.c' source file.
    This issue can be triggered by processing a corrupted     dump file and will result in hcidump     crash.(CVE-2016-9917)

  - In BlueZ 5.42, an out-of-bounds read was identified in     'packet_hexdump' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the bluez packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In BlueZ 5.42, a buffer overflow was observed in     'commands_dump' function in 'tools/parser/csr.c' source     file. The issue exists because 'commands' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'frm->ptr' parameter. This issue can be triggered by     processing a corrupted dump file and will result in     hcidump crash.(CVE-2016-9804)

  - In BlueZ 5.42, a buffer overflow was observed in     'pin_code_reply_dump' function in 'tools/parser/hci.c'     source file. The issue exists because 'pin' array is     overflowed by supplied parameter due to lack of     boundary checks on size of the buffer from frame     'pin_code_reply_cp *cp' parameter.(CVE-2016-9800)

  - In BlueZ 5.42, a buffer overflow was observed in     'read_n' function in 'tools/hcidump.c' source file.
    This issue can be triggered by processing a corrupted     dump file and will result in hcidump     crash.(CVE-2016-9917)

  - In BlueZ 5.42, a buffer overflow was observed in     'set_ext_ctrl' function in 'tools/parser/l2cap.c'     source file when processing corrupted dump     file.(CVE-2016-9801)

  - In BlueZ 5.42, a buffer over-read was identified in     'l2cap_packet' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9802)

  - In BlueZ 5.42, a use-after-free was identified in     'conf_opt' function in 'tools/parser/l2cap.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in hcidump     crash.(CVE-2016-9798)

  - In BlueZ 5.42, an out-of-bounds read was identified in     'packet_hexdump' function in 'monitor/packet.c' source     file. This issue can be triggered by processing a     corrupted dump file and will result in btmon     crash.(CVE-2016-9918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bluez fixes the following issues :

Security issues fixed :

CVE-2016-7837: Fixed possible buffer overflow, make sure we don't write past the end of the array.(bsc#1026652)

CVE-2016-9800: Fix hcidump memory leak in pin_code_reply_dump() (bsc#1013721).

CVE-2016-9801: Fixed a buffer overflow in set_ext_ctrl function (bsc#1013732)

CVE-2016-9804: Fix hcidump buffer overflow in commands_dump() (bsc#1013877).

CVE-2016-9918: Fixed an out-of-bounds read in packet_hexdump() (bsc#1015173)

CVE-2017-1000250: Fixed a information leak in SDP (part of the recently published BlueBorne vulnerabilities) (bsc#1057342)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bluez fixes the following issues: Security issues fixed :

  - CVE-2016-9800: Fix hcidump memory leak in     pin_code_reply_dump() (bsc#1013721).

  - CVE-2016-9804: Fix hcidump buffer overflow in     commands_dump() (bsc#1013877).

  - CVE-2016-7837: Fix possible buffer overflow, make sure     we don't write past the end of the array (bsc#1026652).

  - CVE-2017-1000250: Fix information disclosure     vulnerability in service_search_attr_req (bsc#1057342).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
151392	EulerOS Virtualization 3.0.2.2 : bluez (EulerOS-SA-2021-2129)	Nessus	Huawei Local Security Checks	high
151295	EulerOS Virtualization for ARM 64 3.0.2.0 : bluez (EulerOS-SA-2021-2088)	Nessus	Huawei Local Security Checks	high
147616	EulerOS Virtualization 3.0.6.6 : bluez (EulerOS-SA-2021-1460)	Nessus	Huawei Local Security Checks	high
147516	EulerOS Virtualization 3.0.2.6 : bluez (EulerOS-SA-2021-1427)	Nessus	Huawei Local Security Checks	high
146182	EulerOS 2.0 SP5 : bluez (EulerOS-SA-2021-1179)	Nessus	Huawei Local Security Checks	high
132276	EulerOS 2.0 SP3 : bluez (EulerOS-SA-2019-2559)	Nessus	Huawei Local Security Checks	high
131872	EulerOS 2.0 SP2 : bluez (EulerOS-SA-2019-2380)	Nessus	Huawei Local Security Checks	high
122530	SUSE SLES12 Security Update : bluez (SUSE-SU-2019:0510-1) (BlueBorne)	Nessus	SuSE Local Security Checks	high
110661	SUSE SLED12 / SLES12 Security Update : bluez (SUSE-SU-2018:1778-1) (BlueBorne)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-9804

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high