ESB-2021.2248 – [Debian] bluez: Multiple vulnerabilities

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

===========================================================================
AUSCERT External Security Bulletin Redistribution

ESB-2021.2248
bluez security update
28 June 2021

===========================================================================

AusCERT Security Bulletin Summary
———————————

Product: bluez
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Provide Misleading Information — Remote/Unauthenticated
Access Confidential Data — Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-0129 CVE-2020-26558

Reference: ESB-2021.2217
ESB-2021.2145
ESB-2021.2023

Original Bulletin:
https://lists.debian.org/debian-lts-announce/2021/06/msg00022.html

– ————————–BEGIN INCLUDED TEXT——————–

– —–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512

– – ————————————————————————-
Debian LTS Advisory DLA-2692-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Thorsten Alteholz
June 27, 2021 https://wiki.debian.org/LTS
– – ————————————————————————-

Package : bluez
Version : 5.43-2+deb9u4
CVE ID : CVE-2020-26558 CVE-2021-0129

Two issues have been found in bluez, a package with Bluetooth tools and
daemons. One issue is about a man-in-the-middle attack during secure
pairing, the other is about information disclosure due to improper access
control.

In order to completely fix both issues, you need an updated kernel as
well! For Debian 9 Stretch this has been uploaded some days ago.

For Debian 9 stretch, these problems have been fixed in version
5.43-2+deb9u4.

We recommend that you upgrade your bluez packages.

For the detailed security status of bluez please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/bluez

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

– —–BEGIN PGP SIGNATURE—–

iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmDXt7ZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEdicQ//elZQc67ewyknK0VVuzR4Gm13jxBGOi6ZkQaaQ9H7AjJEftQtkbqk4aYG
JGj5gwghRW8wXurFcaBiV+Ek8Oxo9HmX7WcaugZolaSSOblV95esbdF7Tj0McjV2
/BD4MKTMc5kBAo2KFmoSfBFllMCZ8ErEOtx76G00kBDe7kJi7aBuRArlx0YiNDyu
YLdfwa7U8ASAOGFVIqumQpBFBv1vH2cOqmEgt6moM73cgoBJE7Mcjp5WU/4jdwJn
kUMk486ubGZSN/1yHeCqgvohnombACNE8yjJAhytGweycBWR8iZEaQYLNn5/Kx4m
54+wN0Jqdec3HceoQhpchQXZo5NL7x39bWhSZhfdbri8pcYX7eYD1T8j/o8MsEwK
COCv+kQnpNcmY+xICGLRRKCQsG93CMSHy/PNgpvQTKMWwKLOxVO5yFvdrBWz3tfI
05nwfFcHRkVaKcwOAPQV3l2bFf96H2Zop7xmkNTTsLBHW596+dENoOqzMijBiaV4
Iw+8aR2dhy3yxzhmsrMf/svNKR6aUU28Bwp6BCPQeqNQsrg3sUuw6933lJIx9aWI
FcNAb6DAx74lYJawMUyokHgKTlpPyIbHW+osKxj0PWGf87D4FCI4bdELH/KGlfuU
QExMVbtxNpxs92xECqMmZND8R8qp7rGP2+KHCY0yelByGs9VhXY=
=7lQ2
– —–END PGP SIGNATURE—–

– ————————–END INCLUDED TEXT——————–

You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYNlK+ONLKJtyKPYoAQhBsQ/9GCzQfaWx19rcUndpDgWJladwn3mvogKR
X6kSDx7JC7Z9huck38/6B05Fs1wzNhY3BLvJawVwfA+Ge1FnXFCy7o/066vQURbG
nwpAW2uOIIFqvMPC5wF/nqUIOR1hoDj5cCXk43bfzb/eWjJwTvGs3HVbwkabZNda
My0G6wSIRUjEZHDS5VaWXTxk7ToOYzqfVzvie4ji3ZTiMjQPiLJhZzRDD72pUqAj
ICY9lY2tygntd+E83ON05kd0Qhng6rBpqkzuFw6GB8YEQIhEwvfNxIev5eYdGi01
7rbhffwKOc/ZcX9qQ9ucPe9RPQEx2P5lbQ1ZhjudygHvGQPsq81mm8DpGQt16B7C
4MaK3oE2Gt/2CSEYyBzw9ucmC9vhfKQJ03kXTtTLp2XaBFmVQZ9zDtukMbPRXVHX
U0SzLiJFPPV3hJQaXT/NVFKm16mGpAn6PtzmKJu5+xB6INjE+rIz3li3J22+JV1Y
hXedgWUe66OfiBh99oRCg/xtdNe+tFLeA45EjBnBXIWnGneRgw3LZKjd8dRX76VG
3umx6efbHGRvO2AhnmEz2eJzwwt8IA1VTeQnwjrqOQN+7DlctnvMSQCKnmXT5tVa
zqjZml1GhPw3ip8bZJte13ldaA18QOW/bxOe/yrHMagp1Gam5N5IJTlQ8BiAtsGl
yAdTYiTfgRA=
=p7j+
—–END PGP SIGNATURE—–

Read More

The post ESB-2021.2248 – [Debian] bluez: Multiple vulnerabilities appeared first on Malware Devil.

https://malwaredevil.com/2021/06/28/esb-2021-2248-debian-bluez-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-2248-debian-bluez-multiple-vulnerabilities