BlueZ Phone Book Access Profile Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the handling of the Phone Book Access profile. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20938.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "libbluetooth3": "5.72-0ubuntu5", "bluez-dbgsym": "5.72-0ubuntu5", "bluez-hcidump": "5.72-0ubuntu5", "bluez-hcidump-dbgsym": "5.72-0ubuntu5", "bluez-obexd-dbgsym": "5.72-0ubuntu5", "bluez-meshd-dbgsym": "5.72-0ubuntu5", "bluez-cups-dbgsym": "5.72-0ubuntu5", "bluez-test-scripts": "5.72-0ubuntu5", "bluez-source": "5.72-0ubuntu5", "libbluetooth-dev": "5.72-0ubuntu5", "bluez-test-tools": "5.72-0ubuntu5", "bluez-test-tools-dbgsym": "5.72-0ubuntu5", "bluez-meshd": "5.72-0ubuntu5", "bluetooth": "5.72-0ubuntu5", "libbluetooth3-dbgsym": "5.72-0ubuntu5", "bluez-cups": "5.72-0ubuntu5", "bluez": "5.72-0ubuntu5", "bluez-obexd": "5.72-0ubuntu5" } ] }