Mandriva: Updated bluez/bluez-utils packages fix SDP packet parsing vulnerability


 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) Mandriva: Updated bluez/bluez-utils packages fix SDP packet parsing vulnerability
# 1  
Old 07-15-2008
Mandriva: Updated bluez/bluez-utils packages fix SDP packet parsing vulnerability

LinuxSecurity.com: An input validation flaw was found in the Bluetooth Session Description Protocol (SDP) packet parser used in the Bluez bluetooth utilities. A bluetooth device with an already-trusted relationship, or a local user registering a service record via a UNIX socket or D-Bus interface, could cause a crash and potentially execute arbitrary code with the privileges of the hcid daemon (CVE-2008-2374). The updated packages have been patched to correct this issue.

More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question
SDPCONTROL(8)						    BSD System Manager's Manual 					     SDPCONTROL(8)

NAME
sdpcontrol -- Bluetooth Service Discovery Protocol query utility SYNOPSIS
sdpcontrol -h sdpcontrol -a address command [parameters ...] sdpcontrol -l [-c path] command [parameters ...] DESCRIPTION
The sdpcontrol utility attempts to query the specified Service Discovery Protocol (SDP) server. Remote SDP servers are identified by their address. Connection to the local SDP server is made via the control socket. The sdpcontrol utility uses Service Search Attribute Requests and prints results to standard output and error messages to standard error. The options are as follows: -a address Connect to the remote device with the specified address. The address can be specified as BD_ADDR or a name. If a name was speci- fied, the sdpcontrol utility attempts to resolve the name via bt_gethostbyname(3). -c path Specify path to the control socket. The default path is /var/run/sdp. -h Display usage message and exit. -l Query the local SDP server via the control socket. command One of the supported commands (see below). The special command help can be used to obtain a list of all supported commands. To get more information about a specific command, use help command. parameters One or more optional space separated command parameters. COMMANDS
The currently supported node commands in sdpcontrol are: Browse Search EXIT STATUS
The sdpcontrol utility exits 0 on success, and >0 if an error occurs. SEE ALSO
bluetooth(3), sdp(3) AUTHORS
Maksim Yevmenkin <m_evmenkin@yahoo.com> CAVEATS
The sdpcontrol utility only implements client side functionality. The sdpcontrol utility only requests the following attributes from the SDP server: 1. Service Record Handle 2. Service Class ID List 3. Protocol Descriptor List 4. Bluetooth Profile Descriptor List BSD
February 7, 2015 BSD