SB2019012808 - Security restrictions bypass in Bluez
Published: January 28, 2019 Updated: December 2, 2019
Security Bulletin ID
SB2019012808
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Physical access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2018-10910)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists in BlueZ due to an error that may allow an attacker to turn on the Bluetooth Discoverable state, when no Bluetooth agent is registered with the system. A remote attacker with physical proximity to the device can remotely turn on Bluetooth agent and access the device without authorization in some cases.
Remediation
Install update from vendor's website.