Security Fix(es) :

  - An information-disclosure flaw was found in the     bluetoothd implementation of the Service Discovery     Protocol (SDP). A specially crafted Bluetooth device     could, without prior pairing or user interaction,     retrieve portions of the bluetoothd process memory,     including potentially sensitive information such as     Bluetooth encryption keys. (CVE-2017-1000250)

The SDP server in BlueZ is vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests.

For Debian 7 'Wheezy', these problems have been fixed in version 4.99-2+deb7u1.

We recommend that you upgrade your bluez packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bluez fixes the following issues: Security issues fixed :

  - CVE-2016-9800: Fix hcidump memory leak in     pin_code_reply_dump() (bsc#1013721).

  - CVE-2016-9804: Fix hcidump buffer overflow in     commands_dump() (bsc#1013877).

  - CVE-2016-7837: Fix possible buffer overflow, make sure     we don't write past the end of the array (bsc#1026652).

  - CVE-2017-1000250: Fix information disclosure     vulnerability in service_search_attr_req (bsc#1057342).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.05, has bluez packages installed that are affected by a vulnerability:

  - An information-disclosure flaw was found in the     bluetoothd implementation of the Service Discovery     Protocol (SDP). A specially crafted Bluetooth device     could, without prior pairing or user interaction,     retrieve portions of the bluetoothd process memory,     including potentially sensitive information such as     Bluetooth encryption keys. (CVE-2017-1000250)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3413-1 advisory.

    It was discovered that an information disclosure vulnerability existed in the Service Discovery Protocol     (SDP) implementation in BlueZ. A physically proximate unauthenticated attacker could use this to disclose     sensitive information. (CVE-2017-1000250)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2017-1000250

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New bluez packages are available for Slackware 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue.

This update for bluez fixes the following vulnerabilities :

  - CVE-2016-7837: Buffer overflow in parse_line function     (bsc#1026652)

  - CVE-2017-1000250: information disclosure vulnerability     in service_search_attr_req (bsc#1057342)

According to the version of the bluez package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - An information-disclosure flaw was found in the     bluetoothd implementation of the Service Discovery     Protocol (SDP). A specially crafted Bluetooth device     could, without prior pairing or user interaction,     retrieve portions of the bluetoothd process memory,     including potentially sensitive information such as     Bluetooth encryption keys.(CVE-2017-1000250)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
103173	Scientific Linux Security Update : bluez on SL6.x, SL7.x i386/x86_64 (20170912) (BlueBorne)	Nessus	Scientific Linux Local Security Checks	2017/9/13	2025/11/21	medium
103390	Debian DLA-1103-1 : bluez security update (BlueBorne)	Nessus	Debian Local Security Checks	2017/9/22	2025/11/20	medium
110661	SUSE SLED12 / SLES12 Security Update : bluez (SUSE-SU-2018:1778-1) (BlueBorne)	Nessus	SuSE Local Security Checks	2018/6/22	2024/9/17	high
127358	NewStart CGSL MAIN 4.05 : bluez Vulnerability (NS-SA-2019-0117)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2024/5/7	medium
103187	Ubuntu 14.04 LTS / 16.04 LTS : BlueZ vulnerability (USN-3413-1)	Nessus	Ubuntu Local Security Checks	2017/9/13	2024/8/27	medium
103202	Fedora 26 : bluez (2017-fe95a5b88b) (BlueBorne)	Nessus	Fedora Local Security Checks	2017/9/14	2025/11/21	medium
103255	Slackware 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : bluez (SSA:2017-258-01) (BlueBorne)	Nessus	Slackware Local Security Checks	2017/9/18	2025/11/21	medium
104080	openSUSE Security Update : bluez (openSUSE-2017-1176) (BlueBorne)	Nessus	SuSE Local Security Checks	2017/10/23	2025/11/18	high
124881	EulerOS Virtualization for ARM 64 3.0.1.0 : bluez (EulerOS-SA-2019-1378)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	medium

检测

插件搜索

medium

medium

high

medium

medium

medium

medium

high

medium