PT-2005-5103 · Belkin+2 · Belkin Bluetooth+2

Published 2005-12-20 · Updated 2018-10-19 · CVE-2005-4417

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Widcomm Bluetooth for Windows (BTW) versions 4.0.1.1500 and earlier Belkin Bluetooth Software version 1.4.2 Build 10 and earlier ANYCOM Blue USB-130-250 Software versions 4.0.1.1500 and earlier

Description The issue concerns the default configuration of certain Bluetooth software, which sets null Authentication and Authorization values. This allows remote attackers to send arbitrary audio and possibly eavesdrop using the microphone via the Hands Free Audio Gateway and Headset profile.

Recommendations For Widcomm Bluetooth for Windows (BTW) versions 4.0.1.1500 and earlier, update the configuration to set proper Authentication and Authorization values. For Belkin Bluetooth Software version 1.4.2 Build 10 and earlier, update the configuration to set proper Authentication and Authorization values. For ANYCOM Blue USB-130-250 Software versions 4.0.1.1500 and earlier, update the configuration to set proper Authentication and Authorization values. As a temporary workaround, consider disabling the Hands Free Audio Gateway and Headset profile until a proper configuration is in place.

Exploit

Fix

Related Identifiers

CVE-2005-4417

Affected Products

Anycom Blue Usb-130-250

Belkin Bluetooth

Widcomm Bluetooth For Windows

References · 3

• 🔥 https://exploit-db.com/exploits/1357 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4417 · Security Note
• http://securityfocus.com/archive/1/419642/100/0/threaded · Note