CVE-2008-2374
published 2008-07-07CVE-2008-2374: src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP…
PriorityP333critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.29%
90.0th percentile
src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bluez | bluez-libs | < 3.34 | 3.34 |
| bluez | bluez-utils | < 3.34 | 3.34 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
bluez-libs: SDP payload processing vulnerability
vendor_redhat·2008-06-16·CVSS 9.8
CVE-2008-2374 [CRITICAL] bluez-libs: SDP payload processing vulnerability
bluez-libs: SDP payload processing vulnerability
src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.
GHSA
GHSA-278x-6vg6-6g42: src/sdp
ghsa_unreviewed·2022-05-01
CVE-2008-2374 [HIGH] CWE-1284 GHSA-278x-6vg6-6g42: src/sdp
src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2008-2374 bluez-libs: SDP payload processing vulnerability [F9]
bugzilla·2008-06-25·CVSS 9.8
CVE-2008-2374 [CRITICAL] CVE-2008-2374 bluez-libs: SDP payload processing vulnerability [F9]
CVE-2008-2374 bluez-libs: SDP payload processing vulnerability [F9]
F9 tracking bug: see blocks bug list for full details of the security issue(s).
This bug is never intended to be made public, please put any public notes in the 'blocks' bugs.
NOTE THIS ISSUE IS CURRENTLY EMBARGOED, DO NOT MAKE PUBLIC COMMITS OR COMMENTS ABOUT THIS ISSUE.
[bug automatically created by: add-tracking-bugs]
Discussion:
bluez-utils-3.35-2.fc9, bluez-libs-3.35-1.fc9 has been pushed to the Fedora 9 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
su -c 'yum --enablerepo=updates-testing update bluez-utils bluez-libs'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F9/FEDORA
Bugzilla
CVE-2008-2374 bluez-libs: SDP payload processing vulnerability [Fdevel]
bugzilla·2008-06-25·CVSS 9.8
CVE-2008-2374 [CRITICAL] CVE-2008-2374 bluez-libs: SDP payload processing vulnerability [Fdevel]
CVE-2008-2374 bluez-libs: SDP payload processing vulnerability [Fdevel]
Fdevel tracking bug: see blocks bug list for full details of the security issue(s).
This bug is never intended to be made public, please put any public notes in the 'blocks' bugs.
NOTE THIS ISSUE IS CURRENTLY EMBARGOED, DO NOT MAKE PUBLIC COMMITS OR COMMENTS ABOUT THIS ISSUE.
[bug automatically created by: add-tracking-bugs]
Discussion:
Fixed in bluez-utils-3.35-2.fc10 and bluez-libs-3.35-1.fc10
Bugzilla
CVE-2008-2374 bluez-libs: SDP payload processing vulnerability [F8]
bugzilla·2008-06-25·CVSS 9.8
CVE-2008-2374 [CRITICAL] CVE-2008-2374 bluez-libs: SDP payload processing vulnerability [F8]
CVE-2008-2374 bluez-libs: SDP payload processing vulnerability [F8]
F8 tracking bug: see blocks bug list for full details of the security issue(s).
This bug is never intended to be made public, please put any public notes in the 'blocks' bugs.
NOTE THIS ISSUE IS CURRENTLY EMBARGOED, DO NOT MAKE PUBLIC COMMITS OR COMMENTS ABOUT THIS ISSUE.
[bug automatically created by: add-tracking-bugs]
Discussion:
bluez-utils-3.35-1.fc8, bluez-libs-3.35-1.fc8 has been pushed to the Fedora 8 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
su -c 'yum --enablerepo=updates-testing update bluez-utils bluez-libs'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F8/FEDORA
Bugzilla
CVE-2008-2374 bluez-libs: SDP payload processing vulnerability
bugzilla·2008-06-24·CVSS 9.8
CVE-2008-2374 [CRITICAL] CVE-2008-2374 bluez-libs: SDP payload processing vulnerability
CVE-2008-2374 bluez-libs: SDP payload processing vulnerability
Description of problem:
The SDP parsing code blindly trusts string length fields in incoming
SDP packets, exposing reliant applications to over-the-wireless memory
manipulation attacks. An attacker need only send a malformed
response to an SDP query to take advantage of this.
This is most apparent in file bluez-libs-3.30/src/sdp.c, lines 988,
994, 1002 (see below). Also elsewhere in the code where input
pointers are advanced without checking bytes remaining to be parsed.
The root of the problem is that in bluez-libs-3.30/src/sdp.c:1125, the
function sdp_extract_pdu() takes a buffer to parse (in) and a pointer
to a length field (out), but it does not take an incoming length field
(in).
Attached is a patch to fix this issue.
CWE
Improper Input Validation
mitre_cwe
CWE-20 Improper Input Validation
CWE-20: Improper Input Validation
The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.
Input validation is a frequently-used technique
for checking potentially dangerous inputs in order to
ensure that the inputs are safe for processing within the
code, or when communicating with other components. Input can consist of: raw data - strings, numbers, parameters, file contents, etc. metadata - information about the raw data, such as headers or size Data can be simple or structured. Structured data
can be composed of many nested layers, composed of
combinations of metadata and raw data, with other simple or
structured data. Many properties of raw data or metadata may n
CWE
Improper Validation of Specified Quantity in Input
mitre_cwe
CWE-1284 Improper Validation of Specified Quantity in Input
CWE-1284: Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Specified quantities include size, length, frequency, price, rate, number of operations, time, and others. Code may rely on specified quantities to allocate resources, perform calculations, control iteration, etc.
Modes of Introduction:
Phase: Implementation
Note: Since quantities are often used to affect resource allocation or process financial data, they are often present in many places in the code.
Common Consequences:
Scope: Other, Integrity, Availability. Impact: Varies by Context, DoS: Resource Consumption (CPU), Modify Memory, Read M
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.htmlhttp://secunia.com/advisories/30957http://secunia.com/advisories/31057http://secunia.com/advisories/31833http://secunia.com/advisories/32099http://secunia.com/advisories/32279http://secunia.com/advisories/34280http://security.gentoo.org/glsa/glsa-200903-29.xmlhttp://sourceforge.net/mailarchive/message.php?msg_name=b32d44000806161327u680c290au54fd21f2fef1d58e%40mail.gmail.comhttp://www.bluez.org/bluez-334/http://www.mandriva.com/security/advisories?name=MDVSA-2008:145http://www.redhat.com/support/errata/RHSA-2008-0581.htmlhttp://www.securityfocus.com/bid/30105http://www.securitytracker.com/id?1020479http://www.vupen.com/english/advisories/2008/2096/referenceshttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9973https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00396.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-September/msg00233.htmlhttp://lists.opensuse.org/opensuse-security-announce/2008-09/msg00005.htmlhttp://secunia.com/advisories/30957http://secunia.com/advisories/31057http://secunia.com/advisories/31833http://secunia.com/advisories/32099http://secunia.com/advisories/32279http://secunia.com/advisories/34280http://security.gentoo.org/glsa/glsa-200903-29.xmlhttp://sourceforge.net/mailarchive/message.php?msg_name=b32d44000806161327u680c290au54fd21f2fef1d58e%40mail.gmail.comhttp://www.bluez.org/bluez-334/http://www.mandriva.com/security/advisories?name=MDVSA-2008:145http://www.redhat.com/support/errata/RHSA-2008-0581.htmlhttp://www.securityfocus.com/bid/30105http://www.securitytracker.com/id?1020479http://www.vupen.com/english/advisories/2008/2096/referenceshttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9973https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00396.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-September/msg00233.html
2008-07-07
Published