Oracle Linux 4 / 5 : bluez-libs / bluez-utils (ELSA-2008-0581)

high Nessus Plugin ID 67723

Synopsis

The remote Oracle Linux host is missing one or more security updates.

Description

From Red Hat Security Advisory 2008:0581 :

Updated bluez-libs and bluez-utils packages that fix a security flaw are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The bluez-libs package contains libraries for use in Bluetooth applications. The bluez-utils package contains Bluetooth daemons and utilities.

An input validation flaw was found in the Bluetooth Session Description Protocol (SDP) packet parser used by the Bluez Bluetooth utilities. A Bluetooth device with an already-established trust relationship, or a local user registering a service record via a UNIX(r) socket or D-Bus interface, could cause a crash, or possibly execute arbitrary code with privileges of the hcid daemon.
(CVE-2008-2374)

Users of bluez-libs and bluez-utils are advised to upgrade to these updated packages, which contains a backported patch to correct this issue.

Solution

Update the affected bluez-libs and / or bluez-utils packages.

See Also

https://oss.oracle.com/pipermail/el-errata/2008-July/000677.html

https://oss.oracle.com/pipermail/el-errata/2008-July/000679.html

Plugin Details

Severity: High

ID: 67723

File Name: oraclelinux_ELSA-2008-0581.nasl

Version: 1.10

Type: local

Agent: unix

Published: 7/12/2013

Updated: 1/14/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:oracle:linux:bluez-libs, p-cpe:/a:oracle:linux:bluez-libs-devel, p-cpe:/a:oracle:linux:bluez-utils, p-cpe:/a:oracle:linux:bluez-utils-cups, cpe:/o:oracle:linux:4, cpe:/o:oracle:linux:5

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/OracleLinux

Exploit Ease: No known exploits are available

Patch Publication Date: 7/14/2008

Vulnerability Publication Date: 7/7/2008

Reference Information

CVE: CVE-2008-2374

BID: 30105

CWE: 20

RHSA: 2008:0581