Updated bluez-utils packages that fix a security flaw are now available for Red Hat Enterprise Linux 4. A flaw was found in the Bluetooth HID daemon (hidd). A remote attacker would have been able to inject keyboard and mouse events via a Bluetooth connection without any authorization. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

- ---------------------------------------------------------------------                   Red Hat Security Advisory

Synopsis:          Moderate: bluez-utils security update
Advisory ID:       RHSA-2007:0065-01
Advisory URL:      https://access.redhat.com/errata/RHSA-2007:0065.html
Issue date:        2007-05-14
Updated on:        2007-05-14
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2006-6899 
- ---------------------------------------------------------------------1. Summary:

Updated bluez-utils packages that fix a security flaw are now available for
Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

The bluez-utils package contains Bluetooth daemons and utilities.

A flaw was found in the Bluetooth HID daemon (hidd). A remote attacker
would have been able to inject keyboard and mouse events via a Bluetooth
connection without any authorization. (CVE-2006-6899)

Note that Red Hat Enterprise Linux does not come with the Bluetooth HID
daemon enabled by default.

Users of bluez-utils are advised to upgrade to these updated packages, which
contains a backported patch to correct this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

227014 - CVE-2006-6899 Bluetooth HID key events injection flaw

6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
f7a4d82ed172f4984e8e1abecf723eab  bluez-utils-2.10-2.2.src.rpm

i386:
818e3b413b31f4fc68e6388dc3feca16  bluez-utils-2.10-2.2.i386.rpm
8ab01e39c64083f86da77b56f1b9ed9c  bluez-utils-cups-2.10-2.2.i386.rpm
88944ec7e5a6fa381ec30d9251230827  bluez-utils-debuginfo-2.10-2.2.i386.rpm

ia64:
ba34fe7467efcb74df5896e42261cfb9  bluez-utils-2.10-2.2.ia64.rpm
864af7581f08ad15f6cbd9961fb53880  bluez-utils-cups-2.10-2.2.ia64.rpm
7bc5e16ae46f22aea7208725920de642  bluez-utils-debuginfo-2.10-2.2.ia64.rpm

ppc:
d7a59edfaeb01d98ec4643958c8c5cdd  bluez-utils-2.10-2.2.ppc.rpm
24b8e2e784629942997068f591dca695  bluez-utils-cups-2.10-2.2.ppc.rpm
909bebe0993c4531da2d80b077d63661  bluez-utils-debuginfo-2.10-2.2.ppc.rpm

x86_64:
230bdc2688fb568dd6402d7728c40cb4  bluez-utils-2.10-2.2.x86_64.rpm
2c83d5d0ff12b0d627f609e75586fac4  bluez-utils-cups-2.10-2.2.x86_64.rpm
95964f5ff634df86ff613d0fc0e8c9d1  bluez-utils-debuginfo-2.10-2.2.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
f7a4d82ed172f4984e8e1abecf723eab  bluez-utils-2.10-2.2.src.rpm

i386:
818e3b413b31f4fc68e6388dc3feca16  bluez-utils-2.10-2.2.i386.rpm
8ab01e39c64083f86da77b56f1b9ed9c  bluez-utils-cups-2.10-2.2.i386.rpm
88944ec7e5a6fa381ec30d9251230827  bluez-utils-debuginfo-2.10-2.2.i386.rpm

x86_64:
230bdc2688fb568dd6402d7728c40cb4  bluez-utils-2.10-2.2.x86_64.rpm
2c83d5d0ff12b0d627f609e75586fac4  bluez-utils-cups-2.10-2.2.x86_64.rpm
95964f5ff634df86ff613d0fc0e8c9d1  bluez-utils-debuginfo-2.10-2.2.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
f7a4d82ed172f4984e8e1abecf723eab  bluez-utils-2.10-2.2.src.rpm

i386:
818e3b413b31f4fc68e6388dc3feca16  bluez-utils-2.10-2.2.i386.rpm
8ab01e39c64083f86da77b56f1b9ed9c  bluez-utils-cups-2.10-2.2.i386.rpm
88944ec7e5a6fa381ec30d9251230827  bluez-utils-debuginfo-2.10-2.2.i386.rpm

ia64:
ba34fe7467efcb74df5896e42261cfb9  bluez-utils-2.10-2.2.ia64.rpm
864af7581f08ad15f6cbd9961fb53880  bluez-utils-cups-2.10-2.2.ia64.rpm
7bc5e16ae46f22aea7208725920de642  bluez-utils-debuginfo-2.10-2.2.ia64.rpm

x86_64:
230bdc2688fb568dd6402d7728c40cb4  bluez-utils-2.10-2.2.x86_64.rpm
2c83d5d0ff12b0d627f609e75586fac4  bluez-utils-cups-2.10-2.2.x86_64.rpm
95964f5ff634df86ff613d0fc0e8c9d1  bluez-utils-debuginfo-2.10-2.2.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
f7a4d82ed172f4984e8e1abecf723eab  bluez-utils-2.10-2.2.src.rpm

i386:
818e3b413b31f4fc68e6388dc3feca16  bluez-utils-2.10-2.2.i386.rpm
8ab01e39c64083f86da77b56f1b9ed9c  bluez-utils-cups-2.10-2.2.i386.rpm
88944ec7e5a6fa381ec30d9251230827  bluez-utils-debuginfo-2.10-2.2.i386.rpm

ia64:
ba34fe7467efcb74df5896e42261cfb9  bluez-utils-2.10-2.2.ia64.rpm
864af7581f08ad15f6cbd9961fb53880  bluez-utils-cups-2.10-2.2.ia64.rpm
7bc5e16ae46f22aea7208725920de642  bluez-utils-debuginfo-2.10-2.2.ia64.rpm

x86_64:
230bdc2688fb568dd6402d7728c40cb4  bluez-utils-2.10-2.2.x86_64.rpm
2c83d5d0ff12b0d627f609e75586fac4  bluez-utils-cups-2.10-2.2.x86_64.rpm
95964f5ff634df86ff613d0fc0e8c9d1  bluez-utils-debuginfo-2.10-2.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://access.redhat.com/security/team/key#package

7. References:

https://www.cve.org/CVERecord?id=CVE-2006-6899
https://access.redhat.com/security/updates/classification#moderate

8. Contact:

The Red Hat security contact is .  More contact
details at https://access.redhat.com/security/team/contact

Copyright 2007 Red Hat, Inc.