Bugzilla Bug 230591

** Please note that this issue is SEMI-PUBLIC and no information should be
disclosed until it is made public, see "Whiteboard" for a date **

Glenn Durfee of Google writes:
The SDP parsing code blindly trusts string length fields in incoming
SDP packets, exposing reliant applications to over-the-wireless memory
manipulation attacks.   An attacker need only send a malformed
response to an SDP query to take advantage of this.

This is most apparent in file bluez-libs-3.30/src/sdp.c, lines 988,
994, 1002 (see below).  Also elsewhere in the code where input
pointers are advanced without checking bytes remaining to be parsed.
The root of the problem is that in bluez-libs-3.30/src/sdp.c:1125, the
function sdp_extract_pdu() takes a buffer to parse (in) and a pointer
to a length field (out), but it does not take an incoming length field
(in).

Attached is a patch to fix this issue.  Basically I added a
"bytesleft" argument to all of the SDP payload processing routines;
length fields are checked
against the number of remaining bytes to ensure the parser doesn't run
past the end of the packet, or do crazy things like malloc two gigs of
memory.  This touches a lot of places, and changes the external API
for SDP payload processing, but I don't see any other way to do this
-- the parser MUST be aware of the incoming packet size in order for
this to be secure.

See: http://article.gmane.org/gmane.linux.bluez.devel/15809/


Jan Lieskovsky of RedHat writes:

This issue already public, but the detailed information about its 
security impact not known publit yet, so please handle this as
confidential.


More details about security impact from Marcel Holtmann:
========================================================

It affects the SDP client functionality and I don't see how you can
actually trigger it. The user has to first enter a trusted relationship
with the remote device before unexpected SDP transaction will happen and
then you can do more harm anyway. The exception is that the user has
proximity tool running that scans every device in range, but such things
are neither shipped with RHEL or Fedora.

However today I realized that there is an issue with the SDP service
record registration. As normal user you can register service records via
an old Unix socket interface or via D-Bus. Both times you give the
record in binary form and since hcid is running as root, this could
allow a privilege escalation.

All the information from that blog were in the original email from
Google and that was also public. The post mentions that you could
trigger this remotely. This is a hard stretch since you actually have to
construct a scenario for it. BlueZ will not connect to other devices
without trusting them by default. So that is impact=low.

However the same parsing is used to create service records locally and
hence you have a local privilege escalation. That hasn't been mentioned
publicly at all. Even I overlooked it in my first review of the patches.

Petteri, 3.35 fixes this issue, and you can commit that to CVS. I would suppose
(but I did not research it) that the 2.X branch is also affected. Marcel
forwarded a patch, and we could try backporting it to the 2.X branch to fix
this. However, how do you feel about pushing 3.35 to stable?
I saw that HPPA already went the 3.X road, and stabled 3.30.

All details in here are public via
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-2374

Petteri, patches are available at the bug linked above. Most of the codebase
that is changed there only had cosmetic changes, so porting it to 2.25 seems
feasible. Please let us know how you would like to proceed, either with taking
the steps to stable, or update the old version.

Bumped to 3.36.

(In reply to comment #3)
> Bumped to 3.36.
> 

(In reply to comment #2)
> All details in here are public via
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-2374
> 
> Petteri, patches are available at the bug linked above. Most of the codebase
> that is changed there only had cosmetic changes, so porting it to 2.25 seems
> feasible. Please let us know how you would like to proceed, either with taking
> the steps to stable, or update the old version.
> 

About stabilization of 3.36, is it ok to call ALL arches that had 2.x branch
stable, or just HPPA, which has 3.30 stable?

(In reply to comment #4)
> 
> About stabilization of 3.36, is it ok to call ALL arches that had 2.x branch
> stable, or just HPPA, which has 3.30 stable?
> 

The ebuild dev-zero added is buggy.

The blocking bugs have been resolved, how do you feel about stabling this for
all architectures now?

adding two new blocking bugs that dev-zero pointed out to me. Petteri, can you
take a look at preparing this for stable?

Bug was updated:
http://www.securityfocus.com/bid/30105/info

dev-zero, betelgeuse, what is your timeline for fixing the blockers?

ahem, blockers are gone for some time now...

Arches, please test and mark stable:
Keywords: alpha amd64 arm hppa ia64 ppc ppc64 sh sparc x86
'=net-wireless/bluez-libs-3.3.6'

ppc stable

(In reply to comment #11)
> Arches, please test and mark stable:
> Keywords: alpha amd64 arm hppa ia64 ppc ppc64 sh sparc x86
> '=net-wireless/bluez-libs-3.3.6'

=net-wireless/bluez-libs-3.36 that is

(In reply to comment #12)
> 
> =net-wireless/bluez-libs-3.36 that is
> 

libs itself is of no use, but of course if it works fine with 2* bluez-utils
then we should have marked it stable ages ago. For the 3* series you should
also mark bluez-utils and bluez-gnome.

(In reply to comment #13)
> (In reply to comment #12)
> > 
> > =net-wireless/bluez-libs-3.36 that is
> > 
> 
> libs itself is of no use, but of course if it works fine with 2* bluez-utils
> then we should have marked it stable ages ago. For the 3* series you should
> also mark bluez-utils and bluez-gnome.

ppc has bluez-utils-3.30 stable for about 3 months, bluez-gnome has no stable
version on any architecture - so anything left for us? if so, please specify
which versions you want to have marked as stable. Thanks!

(In reply to comment #14)
> 
> ppc has bluez-utils-3.30 stable for about 3 months, bluez-gnome has no stable
> version on any architecture - so anything left for us? if so, please specify
> which versions you want to have marked as stable. Thanks!
> 

Might as well mark 3.36 for utils too then and bluez-gnome-0.28. Please make
sure obex data transfer works with bluez-gnome.

Sparc stable for:

=net-wireless/bluez-libs-3.36
=net-wireless/bluez-utils-3.36
and
=gnome-extra/gnome-vfs-obexftp-0.4
=app-mobilephone/obex-data-server-0.3
=net-wireless/bluez-gnome-0.28

obex data transfer works fine for both directions (mobile -> pc, pc -> mobile)

All three stable for HPPA.

(In reply to comment #15)
> Might as well mark 3.36 for utils too then and bluez-gnome-0.28. Please make
> sure obex data transfer works with bluez-gnome.

ppc stable for utils, recent bluez-gnome has no ~ppc keyword.

alpha/ia64 keywords dropped, no hardware to test

(In reply to comment #19)
> alpha/ia64 keywords dropped, no hardware to test
> 

Just curious: I have changed profile from default 2007.0 to 2008.0 and suddenly
"emerge -uDpv --newuse world" show quite a few packages, among others also
bluez-libs.

If anything below 3.30 is dangerous, why aren't lower versions masked ?
System wanted to install version 2.25  and choked, so I pached the source and
if something didn't push me to look here, I'd just file a bug and install it...

(In reply to comment #20)
> 
> If anything below 3.30 is dangerous, why aren't lower versions masked ?
> System wanted to install version 2.25  and choked, so I pached the source and
> if something didn't push me to look here, I'd just file a bug and install it...
> 

When arches are done, older versions are removed.

ppc64 done for -libs-3.36 and -utils-3.36

I only have a bluetooth adapter on an amd64 system, but 3.36 works fine on it
since months. My emerge --info:
Portage 2.1.6.4 (default/linux/amd64/2008.0/desktop, gcc-4.1.2, glibc-2.6.1-r0,
2.6.28-tuxonice-r1 x86_64)
=================================================================
System uname:
Linux-2.6.28-tuxonice-r1-x86_64-Intel-R-_Core-TM-2_Duo_CPU_T9300_@_2.50GHz-with-glibc2.2.5
Timestamp of tree: Wed, 28 Jan 2009 21:00:01 +0000
distcc 3.0 x86_64-pc-linux-gnu [disabled]
ccache version 2.4 [enabled]
app-shells/bash:     3.2_p39
dev-java/java-config: 1.3.7-r1, 2.1.6-r1
dev-lang/python:     2.5.2-r7
dev-util/ccache:     2.4-r7
dev-util/cmake:      2.4.8
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.63
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.2
sys-devel/binutils:  2.18-r3
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.27-r2
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=nocona -fomit-frame-pointer"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/config /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/
/etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo
/etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-O2 -pipe -march=nocona -fomit-frame-pointer"
DISTDIR="/usr/distfiles"
FEATURES="autoaddcvs ccache collision-protect cvs distlocks fixpackages
multilib-strict parallel-fetch protect-owned sandbox sfperms strict
unmerge-orphans userfetch"
GENTOO_MIRRORS="ftp://ftp.free.fr/mirrors/ftp.gentoo.org"
LANG="es_ES.UTF-8"
LC_ALL="es_ES.UTF-8"
LDFLAGS="-Wl,-O1"
LINGUAS="es es_ES en_US"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --stats --timeout=180 --exclude=/distfiles
--exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage/layman/sunrise
/usr/local/portage/layman/java-overlay /usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X a52 aac acl acpi alsa amd64 amr avahi bash-completion berkdb bluetooth
branding bzip2 cairo cdda cddb cdparanoia cdr cli consolekit cracklib crypt css
cups daap dbus dell dirac divx djvu dts dvd dvdr dvdread dvi eds emboss emovix
encode epiphany evo exif fam fbcondecor fbsplash ffmpeg flac fortran fuse
galago gdbm gif glitz gmedia gnome gnome-keyring gpm gsm gstreamer gtk hal
iconv ieee1394 ipv6 isdnlog java java6 jpeg jpeg2k kdeenablefinal
kdehiddenvisibility kpathsea ladspa laptop latex lcms ldap libnotify lirc lzma
mad midi mikmod mjpeg mmx mmxext mono moonlight mp3 mpeg mudflap multilib
musepack musicbrainz nautilus ncurses network network-cron networkmanager nls
nptl nptlonly ntp ogg opengl openmp pam pch pcre pdf perl png ppds pppd python
qt3 qt3support qt4 quicktime readline realmedia reflection scanner schroedinger
sdl session smp sms speex spell spl sse sse2 sse3 ssl ssse3
startup-notification svg sysfs t1lib tcpd theora threads tiff totem truetype
unicode usb v4l2 vcd vhook vorbis wmf wmp x264 xattr xcb xft xinetd xml xorg
xulrunner xv xvid zeroconf zlib" ALSA_CARDS="hda-intel" ALSA_PCM_PLUGINS="adpcm
alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa
lfloat linear meter mmap_emul mulaw multi null plug rate route share shm
softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon
authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile
authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate
dir disk_cache env expires ext_filter file_cache filter headers include info
log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling
status unique_id userdir usertrack vhost_alias" ELIBC="glibc"
INPUT_DEVICES="keyboard mouse synaptics" KERNEL="linux" LCD_DEVICES="bayrad
cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="es
es_ES en_US" USERLAND="GNU" VIDEO_CARDS="nvidia nv"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK,
PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

amd64,x86: Are you lacking hardware to test? I can mail you a bluetooth adapter
or trustees are quite likely to sponsor if needed.

(In reply to comment #24)
> amd64,x86: Are you lacking hardware to test? I can mail you a bluetooth adapter
> or trustees are quite likely to sponsor if needed.
> 

I am an AMD64 arch tester and Bluetooth works fine with these since months on
my amd64 system (sorry, but my x86 doesn't have bluetooth adapter):

Portage 2.1.6.4 (default/linux/amd64/2008.0/desktop, gcc-4.1.2,
glibc-2.8_p20080602-r1, 2.6.28-tuxonice-r1 x86_64)
=================================================================
System uname:
Linux-2.6.28-tuxonice-r1-x86_64-Intel-R-_Core-TM-2_Duo_CPU_T9300_@_2.50GHz-with-glibc2.2.5
Timestamp of tree: Sat, 14 Feb 2009 20:10:13 +0000
distcc 3.0 x86_64-pc-linux-gnu [disabled]
ccache version 2.4 [enabled]
app-shells/bash:     3.2_p39
dev-java/java-config: 2.1.6-r1
dev-lang/python:     2.5.2-r7
dev-util/ccache:     2.4-r7
dev-util/cmake:      2.4.8
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.63
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.2
sys-devel/binutils:  2.18-r3
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.27-r2
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=nocona -fomit-frame-pointer"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/config /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/
/etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo
/etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-O2 -pipe -march=nocona -fomit-frame-pointer"
DISTDIR="/usr/distfiles"
FEATURES="autoaddcvs ccache collision-protect cvs distlocks fixpackages
multilib-strict parallel-fetch protect-owned sandbox sfperms strict
unmerge-orphans userfetch"
GENTOO_MIRRORS="ftp://ftp.free.fr/mirrors/ftp.gentoo.org"
LANG="es_ES.UTF-8"
LC_ALL="es_ES.UTF-8"
LDFLAGS="-Wl,-O1"
LINGUAS="es es_ES en_US"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --stats --timeout=180 --exclude=/distfiles
--exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage/layman/sunrise
/usr/local/portage/layman/wschlich-testing /usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X a52 aac acl acpi alsa amd64 amr avahi bash-completion berkdb bluetooth
branding bzip2 cairo cdda cddb cdparanoia cdr cli consolekit cracklib crypt css
cups daap dbus dell dirac divx djvu dts dvd dvdr dvdread dvi eds emboss emovix
encode epiphany evo exif fam fbcondecor fbsplash ffmpeg flac fortran fuse
galago gdbm gif glitz gmedia gnome gnome-keyring gpm gsm gstreamer gtk hal
iconv ieee1394 ipv6 isdnlog java java6 jpeg jpeg2k kdeenablefinal
kdehiddenvisibility kpathsea laptop latex lcms ldap libnotify lzma mad midi
mikmod mjpeg mmx mmxext mono moonlight mp3 mpeg mudflap multilib musepack
musicbrainz nautilus ncurses network network-cron networkmanager nls nptl
nptlonly ntp ogg opengl openmp pam pch pcre pdf perl png ppds pppd python qt3
qt3support qt4 quicktime readline realmedia reflection scanner schroedinger sdl
session smp sms speex spell spl sse sse2 sse3 ssl ssse3 startup-notification
svg sysfs t1lib tcpd theora threads tiff totem truetype unicode usb v4l2 vcd
vorbis wmf wmp x264 xattr xcb xft xinetd xml xorg xulrunner xv xvid zeroconf
zlib" ALSA_CARDS="hda-intel" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare
dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter
mmap_emul mulaw multi null plug rate route share shm softvol"
APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm
authn_default authn_file authz_dbm authz_default authz_groupfile authz_host
authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir
disk_cache env expires ext_filter file_cache filter headers include info
log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling
status unique_id userdir usertrack vhost_alias" ELIBC="glibc"
INPUT_DEVICES="keyboard mouse synaptics" KERNEL="linux" LCD_DEVICES="bayrad
cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="es
es_ES en_US" USERLAND="GNU" VIDEO_CARDS="nvidia nv"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK,
PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

(In reply to comment #24)
> amd64,x86: Are you lacking hardware to test? I can mail you a bluetooth adapter
> or trustees are quite likely to sponsor if needed.

my amd64 laptop has a bluetooth adaptor - but I haven't gotten it running yet.
I'll have some time next week, probably you can help me set it up...

Could you please do this as the current stable has problems compiling with
current stable according to bug reports.

Why are the trustees on this?

(In reply to comment #28)
> Why are the trustees on this?

see comment #24

*** Bug 260491 has been marked as a duplicate of this bug. ***

amd64 done.

x86 stable

glsa request filed.

GLSA 200903-29