CVE-2018-5383medium
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.
References
http://www.cs.technion.ac.il/~biham/BT/
http://www.securityfocus.com/bid/104879
http://www.securitytracker.com/id/1041432
https://access.redhat.com/errata/RHSA-2019:2169
https://lists.debian.org/debian-lts-announce/2019/04/msg00005.html
https://usn.ubuntu.com/4094-1/
https://usn.ubuntu.com/4095-1/
https://usn.ubuntu.com/4095-2/
https://usn.ubuntu.com/4118-1/
https://www.bluetooth.com/news/unknown/2018/07/bluetooth-sig-security-update
Details
Source: MITRE
Published: 2018-08-07
Updated: 2019-10-03
Type: CWE-347
Risk Information
CVSS v2
Base Score: 4.3
Vector: AV:A/AC:M/Au:N/C:P/I:P/A:N
Impact Score: 4.9
Exploitability Score: 5.5
Severity: MEDIUM
CVSS v3
Base Score: 6.8
Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Impact Score: 5.2
Exploitability Score: 1.6
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*
cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*
cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*
Configuration 2
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 136400 | Ubuntu 16.04 LTS / 18.04 LTS : linux-firmware vulnerability (USN-4351-1) | Nessus | Ubuntu Local Security Checks | medium |
| 132451 | NewStart CGSL CORE 5.05 / MAIN 5.05 : linux-firmware Vulnerability (NS-SA-2019-0251) | Nessus | NewStart CGSL Local Security Checks | medium |
| 129919 | NewStart CGSL CORE 5.04 / MAIN 5.04 : linux-firmware Vulnerability (NS-SA-2019-0204) | Nessus | NewStart CGSL Local Security Checks | medium |
| 128478 | Ubuntu 16.04 LTS / 18.04 LTS : linux-aws vulnerabilities (USN-4118-1) | Nessus | Ubuntu Local Security Checks | critical |
| 128369 | CentOS 7 : linux-firmware (CESA-2019:2169) | Nessus | CentOS Local Security Checks | medium |
| 128239 | Scientific Linux Security Update : linux-firmware on SL7.x x86_64 (20190806) | Nessus | Scientific Linux Local Security Checks | medium |
| 127890 | Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4095-1) | Nessus | Ubuntu Local Security Checks | high |
| 127889 | Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4094-1) | Nessus | Ubuntu Local Security Checks | high |
| 127690 | RHEL 7 : linux-firmware (RHSA-2019:2169) | Nessus | Red Hat Local Security Checks | medium |
| 700552 | Apple iOS < 12.0 Multiple Vulnerabilities (EFAIL, APPLE-SA-2018-9-24-4 and APPLE-SA-2018-10-30-8) | Nessus Network Monitor | Mobile Devices | medium |
| 700550 | Apple iOS < 11.4 Multiple Vulnerabilities (EFAIL) | Nessus Network Monitor | Mobile Devices | high |
| 700518 | macOS < 10.14 Multiple Vulnerabilities | Nessus Network Monitor | Operating System Detection | critical |
| 700517 | macOS 10.13.x < 10.13.6 Multiple Vulnerabilities | Nessus Network Monitor | Operating System Detection | critical |
| 700516 | macOS 10.13.x < 10.13.5 Multiple Vulnerabilities | Nessus Network Monitor | Operating System Detection | critical |
| 123567 | Debian DLA-1747-1 : firmware-nonfree security update | Nessus | Debian Local Security Checks | medium |
| 122579 | openSUSE Security Update : kernel-firmware (openSUSE-2019-275) | Nessus | SuSE Local Security Checks | medium |
| 118178 | macOS < 10.14 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | critical |
| 117632 | Apple iOS < 12.0 Multiple Vulnerabilities (EFAIL) | Nessus | Mobile Devices | critical |
| 117588 | Apple TV < 12 Multiple Vulnerabilities | Nessus | Misc. | medium |
| 111137 | macOS 10.13.x < 10.13.6 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | critical |
| 111136 | macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-004) | Nessus | MacOS X Local Security Checks | critical |
| 110398 | Apple iOS < 11.4 Multiple Vulnerabilities (EFAIL) | Nessus | Mobile Devices | high |
| 110325 | Apple TV < 11.4 Multiple Vulnerabilities | Nessus | Misc. | high |
| 110324 | macOS 10.13.x < 10.13.5 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | critical |