Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 579
Alerts This Week
Warning Icon 1 579

Ubuntu: USN-3413-1 Moderate: BlueZ Exposure of Sensitive Information

ubuntu
Calendar Grey September 12, 2017
Dist Ubuntu Esm H88
Users of Ubuntu 17.04, 16.04, and 14.04 LTS are urged to take immediate action regarding the BlueZ security flaw that poses a risk to private data.
BlueZ could be made to expose sensitive information over bluetooth.

Summary

BlueZ could be made to expose sensitive information over bluetooth.

Software Description:

- bluez: Bluetooth tools and daemons

Details:

It was discovered that an information disclosure vulnerability existed

in the Service Discovery Protocol (SDP) implementation in BlueZ. A

physically proximate unauthenticated attacker could use this to

disclose sensitive information. (CVE-2017-1000250)

Topics%20covered

Topics Covered

security advisory moderate Ubuntu update instructions information exposure Bluetooth disclosure

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  bluez                           5.43-0ubuntu1.1
  libbluetooth3                   5.43-0ubuntu1.1

Ubuntu 16.04 LTS:
  bluez                           5.37-0ubuntu5.1
  libbluetooth3                   5.37-0ubuntu5.1

Ubuntu 14.04 LTS:
  bluez                           4.101-0ubuntu13.3
  libbluetooth3                   4.101-0ubuntu13.3

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3413-1

CVE-2017-1000250

Severity
important
Lowest
Low
Medium
High
Critical

September 12, 2017

Topics%20covered

Topics Covered

security advisory moderate Ubuntu update instructions information exposure Bluetooth disclosure

Package Information

https://launchpad.net/ubuntu/+source/bluez/5.43-0ubuntu1.1
https://launchpad.net/ubuntu/+source/bluez/5.37-0ubuntu5.1
https://launchpad.net/ubuntu/+source/bluez/4.101-0ubuntu13.3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.