PT-2018-1869 · Texas Instruments · Ble-Stack

Ben Seri · Published 2018-06-20 · Updated 2020-08-24 · CVE-2018-16986

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Texas Instruments BLE-STACK versions 2.2.1 and earlier

Description The issue is caused by a buffer overflow in the heap, allowing a remote attacker to gain control of the system by sending specially crafted Bluetooth Low Energy (BLE) messages. This can enable remote attackers to execute arbitrary code via a malformed packet.

Recommendations For Texas Instruments BLE-STACK version 2.2.1, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2018-01471

CVE-2018-16986

Affected Products

Ble-Stack

References · 12

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181101-ap · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16986 · Vendor Advisory
• http://e2e.ti.com/support/wireless-connectivity/bluetooth/f/538/t/742827 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-16986 · Security Note
• http://securityfocus.com/bid/105812 · Note
• http://securitytracker.com/id/1042018 · Note
• http://ti.com/tool/BLE-STACK · Note
• https://kb.cert.org/vuls/id/317277 · Note
• https://bleepingcomputer.com/news/security/new-bleedingbit-vulnerabilities-affect-widely-used-bluetooth-chips · Note
• https://armis.com/bleedingbit · Note
• https://securitylab.ru/news/496261.php · Note