Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetooth plug is running (in discoverable mode), Bluetooth service requests and pairing requests are automatically accepted, allowing physically proximate attackers to pair with a device running an affected version of switchboard-plug-bluetooth without the active consent of the user. By default, elementary OS doesn't expose any services via Bluetooth that allow information to be extracted by paired Bluetooth devices. However, if such services (i.e. contact list sharing software) have been installed, it's possible that attackers have been able to extract data from such services without authorization. If no such services have been installed, attackers are only able to pair with a device running an affected version without authorization and then play audio out of the device or possibly present a HID device (keyboard, mouse, etc...) to control the device. As such, users should check the list of trusted/paired devices and remove any that are not 100% confirmed to be genuine. This is fixed in version 2.3.5. To reduce the likelihood of this vulnerability on an unpatched version, only open the Bluetooth plug for short intervals when absolutely necessary and preferably not in crowded public areas. To mitigate the risk entirely with unpatched versions, do not open the Bluetooth plug within switchboard at all, and use a different method for pairing devices if necessary (e.g. `bluetoothctl` CLI).

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-7d55c00267 advisory.

  - Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an     incorrect authorization vulnerability. When the Bluetooth plug is running (in discoverable mode),     Bluetooth service requests and pairing requests are automatically accepted, allowing physically proximate     attackers to pair with a device running an affected version of switchboard-plug-bluetooth without the     active consent of the user. By default, elementary OS doesn't expose any services via Bluetooth that allow     information to be extracted by paired Bluetooth devices. However, if such services (i.e. contact list     sharing software) have been installed, it's possible that attackers have been able to extract data from     such services without authorization. If no such services have been installed, attackers are only able to     pair with a device running an affected version without authorization and then play audio out of the device     or possibly present a HID device (keyboard, mouse, etc...) to control the device. As such, users should     check the list of trusted/paired devices and remove any that are not 100% confirmed to be genuine. This is     fixed in version 2.3.5. To reduce the likelihood of this vulnerability on an unpatched version, only open     the Bluetooth plug for short intervals when absolutely necessary and preferably not in crowded public     areas. To mitigate the risk entirely with unpatched versions, do not open the Bluetooth plug within     switchboard at all, and use a different method for pairing devices if necessary (e.g. `bluetoothctl` CLI).
    (CVE-2021-21367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-3dedd41a06 advisory.

  - Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an     incorrect authorization vulnerability. When the Bluetooth plug is running (in discoverable mode),     Bluetooth service requests and pairing requests are automatically accepted, allowing physically proximate     attackers to pair with a device running an affected version of switchboard-plug-bluetooth without the     active consent of the user. By default, elementary OS doesn't expose any services via Bluetooth that allow     information to be extracted by paired Bluetooth devices. However, if such services (i.e. contact list     sharing software) have been installed, it's possible that attackers have been able to extract data from     such services without authorization. If no such services have been installed, attackers are only able to     pair with a device running an affected version without authorization and then play audio out of the device     or possibly present a HID device (keyboard, mouse, etc...) to control the device. As such, users should     check the list of trusted/paired devices and remove any that are not 100% confirmed to be genuine. This is     fixed in version 2.3.5. To reduce the likelihood of this vulnerability on an unpatched version, only open     the Bluetooth plug for short intervals when absolutely necessary and preferably not in crowded public     areas. To mitigate the risk entirely with unpatched versions, do not open the Bluetooth plug within     switchboard at all, and use a different method for pairing devices if necessary (e.g. `bluetoothctl` CLI).
    (CVE-2021-21367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
147873	Fedora 32 : switchboard-plug-bluetooth (2021-7d55c00267)	Nessus	Fedora Local Security Checks	Local	high
147859	Fedora 33 : switchboard-plug-bluetooth (2021-3dedd41a06)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2021-21367

high

Tenable Plugins

high

high