RHEL 4 / 5 : bluez-libs and bluez-utils (RHSA-2008:0581)

High Nessus Plugin ID 33497


The remote Red Hat host is missing one or more security updates.


Updated bluez-libs and bluez-utils packages that fix a security flaw are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The bluez-libs package contains libraries for use in Bluetooth applications. The bluez-utils package contains Bluetooth daemons and utilities.

An input validation flaw was found in the Bluetooth Session Description Protocol (SDP) packet parser used by the Bluez Bluetooth utilities. A Bluetooth device with an already-established trust relationship, or a local user registering a service record via a UNIX(r) socket or D-Bus interface, could cause a crash, or possibly execute arbitrary code with privileges of the hcid daemon.

Users of bluez-libs and bluez-utils are advised to upgrade to these updated packages, which contains a backported patch to correct this issue.


Update the affected packages.

See Also



Plugin Details

Severity: High

ID: 33497

File Name: redhat-RHSA-2008-0581.nasl

Version: $Revision: 1.21 $

Type: local

Agent: unix

Published: 2008/07/15

Modified: 2017/01/03

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:bluez-libs, p-cpe:/a:redhat:enterprise_linux:bluez-libs-devel, p-cpe:/a:redhat:enterprise_linux:bluez-utils, p-cpe:/a:redhat:enterprise_linux:bluez-utils-cups, cpe:/o:redhat:enterprise_linux:4, cpe:/o:redhat:enterprise_linux:4.6, cpe:/o:redhat:enterprise_linux:5, cpe:/o:redhat:enterprise_linux:5.2

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2008/07/14

Reference Information

CVE: CVE-2008-2374

BID: 30105

RHSA: 2008:0581

CWE: 20