Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injection vulnerability. The impact highly depends on the system configuration. If Polkit-1 is disabled and for versions lower than 2.0.6, any local user can possibly exploit this. If Polkit-1 is enabled for version 2.0.6 and later, a possible attacker needs to be allowed to use the `org.blueman.dhcp.client` action. That is limited to users in the wheel group in the shipped rules file that do have the privileges anyway. On systems with ISC DHCP client (dhclient), attackers can pass arguments to `ip link` with the interface name that can e.g. be used to bring down an interface or add an arbitrary XDP/BPF program. On systems with dhcpcd and without ISC DHCP client, attackers can even run arbitrary scripts by passing `-c/path/to/script` as an interface name. Patches are included in 2.1.4 and master that change the DhcpClient D-Bus method(s) to accept BlueZ network object paths instead of network interface names. A backport to 2.0(.8) is also available. As a workaround, make sure that Polkit-1-support is enabled and limit privileges for the `org.blueman.dhcp.client` action to users that are able to run arbitrary commands as root anyway in /usr/share/polkit-1/rules.d/blueman.rules.

This update for blueman fixes the following issues :

  - Update to version 2.1.4

  - CVE-2020-15238: Fixed a local denial-of-service in the     D-Bus interface (boo#1178196)

The remote host is affected by the vulnerability described in GLSA-202011-11 (Blueman: Local privilege escalation)

    Where Polkit is not used and the default permissions have been changed       on a specific rule file, control of a local DHCP daemon may be possible.
  Impact :

    A local attacker may be able to achieve root privilege escalation.
  Workaround :

    There is no known workaround at this time.

Update to v2.1.4. Contains security fix for CVE-2020-15238.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vaisha Bernard discovered that Blueman, a graphical bluetooth manager performed insufficient validation on a D-Bus interface, which could result in denial of service or privilege escalation.

For Debian 9 stretch, this problem has been fixed in version 2.0.4-1+deb9u1.

We recommend that you upgrade your blueman packages.

For the detailed security status of blueman please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/blueman

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vaisha Bernard discovered that Blueman, a graphical bluetooth manager performed insufficient validation on a D-Bus interface, which could result in denial of service or privilege escalation.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4605-1 advisory.

    Vaisha Bernard discovered that blueman did not properly sanitize input on

    the d-bus interface to blueman-mechanism. A local attacker could possibly

    use this issue to escalate privileges and run arbitrary code or cause a

    denial of service. (CVE-2020-15238)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
143181	openSUSE Security Update : blueman (openSUSE-2020-1997)	Nessus	SuSE Local Security Checks	high
142826	GLSA-202011-11 : Blueman: Local privilege escalation	Nessus	Gentoo Local Security Checks	high
142588	Fedora 31 : 1:blueman (2020-e083225fa1)	Nessus	Fedora Local Security Checks	high
142577	Fedora 32 : 1:blueman (2020-ebabb6bf76)	Nessus	Fedora Local Security Checks	high
142571	Debian DLA-2430-1 : blueman security update	Nessus	Debian Local Security Checks	high
142533	Fedora 33 : 1:blueman (2020-7c22b25a07)	Nessus	Fedora Local Security Checks	high
142050	Debian DSA-4781-1 : blueman - security update	Nessus	Debian Local Security Checks	high
141932	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Blueman vulnerability (USN-4605-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2020-15238

high

Tenable Plugins

high

high

high

high

high

high

high

high