PT-2018-10177 · Bluez+4 · Bluez+4

Chris Marchesi · Published 2018-07-20 · Updated 2023-02-13 · CVE-2018-10910

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Bluez versions prior to 5.51

Description A bug in the system may allow the Bluetooth Discoverable state to be set to on when no Bluetooth agent is registered, potentially leading to unauthorized pairing of certain Bluetooth devices without authentication.

Recommendations For versions prior to 5.51, update to version 5.51 or later to resolve the issue. As a temporary workaround, consider disabling the Bluetooth Discoverable state when no Bluetooth agent is registered with the system. Restrict access to Bluetooth pairing to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2020-1487

ALT-PU-2020-1523

CESA-2020_1101

CESA-2020_1912

CVE-2018-10910

ELSA-2020-1101

ELSA-2020-1912

MGASA-2020-0152

RHSA-2020:1101

RHSA-2020:1912

RHSA-2020_1101

RHSA-2020_1912

USN-3856-1

Affected Products

Alt Linux

Bluez

Centos

Red Hat

Ubuntu

References · 33

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10910 · Exploit
• https://bdu.fstec.ru/vul/2020-01165 · Security Note
• https://advisories.mageia.org/MGASA-2020-0152.html · Security Note
• https://errata.altlinux.org/ALT-PU-2020-1487 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0152 · Vendor Advisory
• https://usn.ubuntu.com/3856-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-10910 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1912.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3856-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10910 · Security Note
• https://osv.dev/vulnerability/USN-3856-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-10910 · Vendor Advisory
• https://debian.org/security/2020/dsa-4647 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0556 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-10910 · Security Note