SB20200611159 - openEuler 20.03 LTS update for bluez-5.50-8

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2018-10910)

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists in BlueZ due to an error that may allow an attacker to turn on the Bluetooth Discoverable state, when no Bluetooth agent is registered with the system. A remote attacker with physical proximity to the device can remotely turn on Bluetooth agent and access the device without authorization in some cases.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-0556)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to improper access control in subsystem for BlueZ. A remote attacker on the local network can gain elevated privileges on the target system and cause a denial of service (DoS) condition.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2020-1012