PT-2018-3532 · Google+6 · Android+7

Eli Biham + 1 · Publicado 2018-07-16 · Atualizado 2026-03-05 · CVE-2018-5383

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 10.13 iOS versions prior to 11.4 Android versions prior to the 2018-06-05 patch

Description: The issue is related to incorrect validation of cryptographic signatures in Bluetooth drivers for Android, macOS, and iOS operating systems. This can allow an attacker to perform a "man-in-the-middle" attack. The vulnerability is due to insufficient validation of elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.

Recommendations: For macOS versions prior to 10.13, update to version 10.13 or later. For iOS versions prior to 11.4, update to version 11.4 or later. For Android versions prior to the 2018-06-05 patch, apply the 2018-06-05 patch or later.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-325

CWE-347

Identificadores relacionados

BDU:2020-03306

CESA-2019_2169

CVE-2018-5383

DLA-1747-1

OPENSUSE-SU-2019_0275-1

RHSA-2019:2169

RHSA-2019_2169

SUSE-SU-2019:0422-1

SUSE-SU-2019:0427-1

SUSE-SU-2019:0427-2

SUSE-SU-2019:0466-1

SUSE-SU-2019_0422-1

SUSE-SU-2019_0427-1

SUSE-SU-2019_0427-2

SUSE-SU-2019_0466-1

USN-4094-1

USN-4095-1

USN-4095-2

USN-4118-1

USN-4351-1

Produtos afetados

Android

Astra Linux

Centos

Red Hat

Suse

Ubuntu

Ios

Apple Macos

Referências · 111

• https://osv.dev/vulnerability/USN-4094-1 · Aviso do Fabricante
• https://usn.ubuntu.com/4094-1 · Aviso do Fabricante
• https://bluetooth.com/news/unknown/2018/07/bluetooth-sig-security-update · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-4351-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-13093 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-14614 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-13631 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-20511 · Aviso do Fabricante
• https://kb.cert.org/vuls/id/304725 · Nota
• https://usn.ubuntu.com/4095-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-15220 · Aviso do Fabricante
• https://twitter.com/jmcmurry/status/1848502612649468181 · Publicação no Twitter
• https://usn.ubuntu.com/4351-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-4095-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-5383 · Nota