Headline
Ubuntu Security Notice USN-6540-1
Ubuntu Security Notice 6540-1 - It was discovered that BlueZ did not properly restrict non-bonded devices from injecting HID events into the input subsystem. This could allow a physically proximate attacker to inject keystrokes and execute arbitrary commands whilst the device is discoverable.
==========================================================================
Ubuntu Security Notice USN-6540-1
December 07, 2023
bluez vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
BlueZ could be made to give a physically proximate attacker keyboard and
mouse control of a computer.
Software Description:
- bluez: Bluetooth tools and daemons
Details:
It was discovered that BlueZ did not properly restrict non-bonded devices
from injecting HID events into the input subsystem. This could allow a
physically proximate attacker to inject keystrokes and execute arbitrary
commands whilst the device is discoverable.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
bluez 5.68-0ubuntu1.1
libbluetooth3 5.68-0ubuntu1.1
Ubuntu 23.04:
bluez 5.66-0ubuntu1.1
libbluetooth3 5.66-0ubuntu1.1
Ubuntu 22.04 LTS:
bluez 5.64-0ubuntu1.1
libbluetooth3 5.64-0ubuntu1.1
Ubuntu 20.04 LTS:
bluez 5.53-0ubuntu3.7
libbluetooth3 5.53-0ubuntu3.7
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
bluez 5.48-0ubuntu3.9+esm1
libbluetooth3 5.48-0ubuntu3.9+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
bluez 5.37-0ubuntu5.3+esm3
libbluetooth3 5.37-0ubuntu5.3+esm3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6540-1
CVE-2023-45866
Package Information:
https://launchpad.net/ubuntu/+source/bluez/5.68-0ubuntu1.1
https://launchpad.net/ubuntu/+source/bluez/5.66-0ubuntu1.1
https://launchpad.net/ubuntu/+source/bluez/5.64-0ubuntu1.1
https://launchpad.net/ubuntu/+source/bluez/5.53-0ubuntu3.7
Related news
Why the company took so long to address the issue is not known given that most other stakeholders had a fix out for the issue months ago.
By Waqas Another day, another Apple Security Vulnerability! This is a post from HackRead.com Read the original post: Apple Shortcuts Vulnerability Exposes Sensitive Data, Update Now!
Gentoo Linux Security Advisory 202401-3 - Multiple vulnerabilities have been discovered in Bluez, the worst of which can lead to privilege escalation. Versions greater than or equal to 5.70-r1 are affected.
Debian Linux Security Advisory 5584-1 - It was reported that the BlueZ's HID profile implementation is not inline with the HID specification which mandates the use of Security Mode 4. The HID profile configuration option ClassicBondedOnly now defaults to "true" to make sure that input connections only come from bonded device connections.
Apple Security Advisory 12-11-2023-4 - macOS Sonoma 14.2 addresses code execution, out of bounds read, and spoofing vulnerabilities.
Apple Security Advisory 12-11-2023-2 - iOS 17.2 and iPadOS 17.2 addresses code execution and spoofing vulnerabilities.
Apple on Monday released security patches for iOS, iPadOS, macOS, tvOS, watchOS, and Safari web browser to address multiple security flaws, in addition to backporting fixes for two recently disclosed zero-days to older devices. This includes updates for 12 security vulnerabilities in iOS and iPadOS spanning AVEVideoEncoder, ExtensionKit, Find My, ImageIO, Kernel, Safari
Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2. An app may be able to access sensitive user data.
By Waqas Another day, another Bluetooth vulnerability impacting billions of devices worldwide! This is a post from HackRead.com Read the original post: Bluetooth Vulnerability Enables Keystroke Injection on Android, Linux, macOS, iOS
Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.
A critical Bluetooth security flaw could be exploited by threat actors to take control of Android, Linux, macOS and iOS devices. Tracked as CVE-2023-45866, the issue relates to a case of authentication bypass that enables attackers to connect to susceptible devices and inject keystrokes to achieve code execution as the victim. "Multiple Bluetooth stacks have authentication bypass
In parse_gap_data of utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.