SB2017091320 - Debian update for bluez
Published: September 13, 2017
Security Bulletin ID
SB2017091320
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Out-of-bounds read (CVE-ID: CVE-2017-1000250)
The vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.The weakness exists in the bluetoothd implementation of the Service Discovery Protocol (SDP) due to out-of-bounds heap read condition in the service_search_attr_req function. An adjacent attacker send specially crafted requests that has Bluetooth enabled in the SDP server and access sensitive information, such as encryption keys, from bluetoothd process memory.
Successful exploitation of the vulnerability results in information disclosure.
Remediation
Install update from vendor's website.