Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 230591 (CVE-2008-2374) - net-wireless/bluez-libs < 3.36 SDP payload processing vulnerability (CVE-2008-2374)
Summary: net-wireless/bluez-libs < 3.36 SDP payload processing vulnerability (CVE-2008...
Status: RESOLVED FIXED
Alias: CVE-2008-2374
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High major (vote)
Assignee: Gentoo Security
URL: http://article.gmane.org/gmane.linux....
Whiteboard: B1 [glsa]
Keywords: STABLEREQ
: 260491 (view as bug list)
Depends on: 234466 234472 235194
Blocks: 198014 207645 224409 231639 254502 259218 260063 260491
  Show dependency tree
 
Reported: 2008-07-03 00:03 UTC by Robert Buchholz (RETIRED)
Modified: 2020-04-09 19:03 UTC (History)
8 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Buchholz (RETIRED) gentoo-dev 2008-07-03 00:03:38 UTC
** Please note that this issue is SEMI-PUBLIC and no information should be
disclosed until it is made public, see "Whiteboard" for a date **

Glenn Durfee of Google writes:
The SDP parsing code blindly trusts string length fields in incoming
SDP packets, exposing reliant applications to over-the-wireless memory
manipulation attacks.   An attacker need only send a malformed
response to an SDP query to take advantage of this.

This is most apparent in file bluez-libs-3.30/src/sdp.c, lines 988,
994, 1002 (see below).  Also elsewhere in the code where input
pointers are advanced without checking bytes remaining to be parsed.
The root of the problem is that in bluez-libs-3.30/src/sdp.c:1125, the
function sdp_extract_pdu() takes a buffer to parse (in) and a pointer
to a length field (out), but it does not take an incoming length field
(in).

Attached is a patch to fix this issue.  Basically I added a
"bytesleft" argument to all of the SDP payload processing routines;
length fields are checked
against the number of remaining bytes to ensure the parser doesn't run
past the end of the packet, or do crazy things like malloc two gigs of
memory.  This touches a lot of places, and changes the external API
for SDP payload processing, but I don't see any other way to do this
-- the parser MUST be aware of the incoming packet size in order for
this to be secure.

See: http://article.gmane.org/gmane.linux.bluez.devel/15809/

 
Jan Lieskovsky of RedHat writes:

This issue already public, but the detailed information about its 
security impact not known publit yet, so please handle this as
confidential.


More details about security impact from Marcel Holtmann:
========================================================

It affects the SDP client functionality and I don't see how you can
actually trigger it. The user has to first enter a trusted relationship
with the remote device before unexpected SDP transaction will happen and
then you can do more harm anyway. The exception is that the user has
proximity tool running that scans every device in range, but such things
are neither shipped with RHEL or Fedora.

However today I realized that there is an issue with the SDP service
record registration. As normal user you can register service records via
an old Unix socket interface or via D-Bus. Both times you give the
record in binary form and since hcid is running as root, this could
allow a privilege escalation.

All the information from that blog were in the original email from
Google and that was also public. The post mentions that you could
trigger this remotely. This is a hard stretch since you actually have to
construct a scenario for it. BlueZ will not connect to other devices
without trusting them by default. So that is impact=low.

However the same parsing is used to create service records locally and
hence you have a local privilege escalation. That hasn't been mentioned
publicly at all. Even I overlooked it in my first review of the patches.
Comment 1 Robert Buchholz (RETIRED) gentoo-dev 2008-07-03 00:08:02 UTC
Petteri, 3.35 fixes this issue, and you can commit that to CVS. I would suppose (but I did not research it) that the 2.X branch is also affected. Marcel forwarded a patch, and we could try backporting it to the 2.X branch to fix this. However, how do you feel about pushing 3.35 to stable?
I saw that HPPA already went the 3.X road, and stabled 3.30.
Comment 2 Robert Buchholz (RETIRED) gentoo-dev 2008-07-09 20:40:09 UTC
All details in here are public via https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-2374

Petteri, patches are available at the bug linked above. Most of the codebase that is changed there only had cosmetic changes, so porting it to 2.25 seems feasible. Please let us know how you would like to proceed, either with taking the steps to stable, or update the old version.
Comment 3 Tiziano Müller gentoo-dev 2008-08-11 13:50:13 UTC
Bumped to 3.36.
Comment 4 Pierre-Yves Rofes (RETIRED) gentoo-dev 2008-08-11 18:53:01 UTC
(In reply to comment #3)
> Bumped to 3.36.
> 

(In reply to comment #2)
> All details in here are public via
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-2374
> 
> Petteri, patches are available at the bug linked above. Most of the codebase
> that is changed there only had cosmetic changes, so porting it to 2.25 seems
> feasible. Please let us know how you would like to proceed, either with taking
> the steps to stable, or update the old version.
> 

About stabilization of 3.36, is it ok to call ALL arches that had 2.x branch stable, or just HPPA, which has 3.30 stable?
Comment 5 Petteri Räty (RETIRED) gentoo-dev 2008-08-11 21:47:03 UTC
(In reply to comment #4)
> 
> About stabilization of 3.36, is it ok to call ALL arches that had 2.x branch
> stable, or just HPPA, which has 3.30 stable?
> 

The ebuild dev-zero added is buggy.
Comment 6 Robert Buchholz (RETIRED) gentoo-dev 2008-08-14 11:37:04 UTC
The blocking bugs have been resolved, how do you feel about stabling this for all architectures now?
Comment 7 Robert Buchholz (RETIRED) gentoo-dev 2008-08-20 14:31:39 UTC
adding two new blocking bugs that dev-zero pointed out to me. Petteri, can you take a look at preparing this for stable?
Comment 8 Stefan Behte (RETIRED) gentoo-dev Security 2008-09-25 11:35:04 UTC
Bug was updated:
http://www.securityfocus.com/bid/30105/info
Comment 9 Stefan Behte (RETIRED) gentoo-dev Security 2008-10-19 03:52:55 UTC
dev-zero, betelgeuse, what is your timeline for fixing the blockers?
Comment 10 Tiziano Müller gentoo-dev 2008-11-28 21:42:57 UTC
ahem, blockers are gone for some time now...
Comment 11 Stefan Behte (RETIRED) gentoo-dev Security 2008-11-29 09:59:51 UTC
Arches, please test and mark stable:
Keywords: alpha amd64 arm hppa ia64 ppc ppc64 sh sparc x86
'=net-wireless/bluez-libs-3.3.6'
Comment 12 Tobias Scherbaum (RETIRED) gentoo-dev 2008-11-29 18:33:51 UTC
ppc stable

(In reply to comment #11)
> Arches, please test and mark stable:
> Keywords: alpha amd64 arm hppa ia64 ppc ppc64 sh sparc x86
> '=net-wireless/bluez-libs-3.3.6'

=net-wireless/bluez-libs-3.36 that is
Comment 13 Petteri Räty (RETIRED) gentoo-dev 2008-11-29 18:47:42 UTC
(In reply to comment #12)
> 
> =net-wireless/bluez-libs-3.36 that is
> 

libs itself is of no use, but of course if it works fine with 2* bluez-utils then we should have marked it stable ages ago. For the 3* series you should also mark bluez-utils and bluez-gnome.
Comment 14 Tobias Scherbaum (RETIRED) gentoo-dev 2008-11-29 19:04:03 UTC
(In reply to comment #13)
> (In reply to comment #12)
> > 
> > =net-wireless/bluez-libs-3.36 that is
> > 
> 
> libs itself is of no use, but of course if it works fine with 2* bluez-utils
> then we should have marked it stable ages ago. For the 3* series you should
> also mark bluez-utils and bluez-gnome.

ppc has bluez-utils-3.30 stable for about 3 months, bluez-gnome has no stable version on any architecture - so anything left for us? if so, please specify which versions you want to have marked as stable. Thanks!
Comment 15 Petteri Räty (RETIRED) gentoo-dev 2008-11-29 21:08:18 UTC
(In reply to comment #14)
> 
> ppc has bluez-utils-3.30 stable for about 3 months, bluez-gnome has no stable
> version on any architecture - so anything left for us? if so, please specify
> which versions you want to have marked as stable. Thanks!
> 

Might as well mark 3.36 for utils too then and bluez-gnome-0.28. Please make sure obex data transfer works with bluez-gnome.
Comment 16 Friedrich Oslage (RETIRED) gentoo-dev 2008-11-30 16:15:30 UTC
Sparc stable for:

=net-wireless/bluez-libs-3.36
=net-wireless/bluez-utils-3.36
and
=gnome-extra/gnome-vfs-obexftp-0.4
=app-mobilephone/obex-data-server-0.3
=net-wireless/bluez-gnome-0.28

obex data transfer works fine for both directions (mobile -> pc, pc -> mobile)
Comment 17 Jeroen Roovers gentoo-dev 2008-12-01 06:26:05 UTC
All three stable for HPPA.
Comment 18 Tobias Scherbaum (RETIRED) gentoo-dev 2008-12-06 19:40:02 UTC
(In reply to comment #15)
> Might as well mark 3.36 for utils too then and bluez-gnome-0.28. Please make
> sure obex data transfer works with bluez-gnome.

ppc stable for utils, recent bluez-gnome has no ~ppc keyword.

Comment 19 Raúl Porcel (RETIRED) gentoo-dev 2008-12-13 15:07:27 UTC
alpha/ia64 keywords dropped, no hardware to test
Comment 20 Branko Badrljica 2008-12-22 02:44:30 UTC
(In reply to comment #19)
> alpha/ia64 keywords dropped, no hardware to test
> 

Just curious: I have changed profile from default 2007.0 to 2008.0 and suddenly "emerge -uDpv --newuse world" show quite a few packages, among others also bluez-libs.

If anything below 3.30 is dangerous, why aren't lower versions masked ?
System wanted to install version 2.25  and choked, so I pached the source and if something didn't push me to look here, I'd just file a bug and install it...

Comment 21 Petteri Räty (RETIRED) gentoo-dev 2008-12-22 21:41:40 UTC
(In reply to comment #20)
> 
> If anything below 3.30 is dangerous, why aren't lower versions masked ?
> System wanted to install version 2.25  and choked, so I pached the source and
> if something didn't push me to look here, I'd just file a bug and install it...
> 

When arches are done, older versions are removed.
Comment 22 Brent Baude (RETIRED) gentoo-dev 2009-01-08 18:02:05 UTC
ppc64 done for -libs-3.36 and -utils-3.36
Comment 23 Pacho Ramos gentoo-dev 2009-01-29 08:11:28 UTC
I only have a bluetooth adapter on an amd64 system, but 3.36 works fine on it since months. My emerge --info:
Portage 2.1.6.4 (default/linux/amd64/2008.0/desktop, gcc-4.1.2, glibc-2.6.1-r0, 2.6.28-tuxonice-r1 x86_64)
=================================================================
System uname: Linux-2.6.28-tuxonice-r1-x86_64-Intel-R-_Core-TM-2_Duo_CPU_T9300_@_2.50GHz-with-glibc2.2.5
Timestamp of tree: Wed, 28 Jan 2009 21:00:01 +0000
distcc 3.0 x86_64-pc-linux-gnu [disabled]
ccache version 2.4 [enabled]
app-shells/bash:     3.2_p39
dev-java/java-config: 1.3.7-r1, 2.1.6-r1
dev-lang/python:     2.5.2-r7
dev-util/ccache:     2.4-r7
dev-util/cmake:      2.4.8
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.63
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.2
sys-devel/binutils:  2.18-r3
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.27-r2
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=nocona -fomit-frame-pointer"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/config /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo /etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-O2 -pipe -march=nocona -fomit-frame-pointer"
DISTDIR="/usr/distfiles"
FEATURES="autoaddcvs ccache collision-protect cvs distlocks fixpackages multilib-strict parallel-fetch protect-owned sandbox sfperms strict unmerge-orphans userfetch"
GENTOO_MIRRORS="ftp://ftp.free.fr/mirrors/ftp.gentoo.org"
LANG="es_ES.UTF-8"
LC_ALL="es_ES.UTF-8"
LDFLAGS="-Wl,-O1"
LINGUAS="es es_ES en_US"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage/layman/sunrise /usr/local/portage/layman/java-overlay /usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X a52 aac acl acpi alsa amd64 amr avahi bash-completion berkdb bluetooth branding bzip2 cairo cdda cddb cdparanoia cdr cli consolekit cracklib crypt css cups daap dbus dell dirac divx djvu dts dvd dvdr dvdread dvi eds emboss emovix encode epiphany evo exif fam fbcondecor fbsplash ffmpeg flac fortran fuse galago gdbm gif glitz gmedia gnome gnome-keyring gpm gsm gstreamer gtk hal iconv ieee1394 ipv6 isdnlog java java6 jpeg jpeg2k kdeenablefinal kdehiddenvisibility kpathsea ladspa laptop latex lcms ldap libnotify lirc lzma mad midi mikmod mjpeg mmx mmxext mono moonlight mp3 mpeg mudflap multilib musepack musicbrainz nautilus ncurses network network-cron networkmanager nls nptl nptlonly ntp ogg opengl openmp pam pch pcre pdf perl png ppds pppd python qt3 qt3support qt4 quicktime readline realmedia reflection scanner schroedinger sdl session smp sms speex spell spl sse sse2 sse3 ssl ssse3 startup-notification svg sysfs t1lib tcpd theora threads tiff totem truetype unicode usb v4l2 vcd vhook vorbis wmf wmp x264 xattr xcb xft xinetd xml xorg xulrunner xv xvid zeroconf zlib" ALSA_CARDS="hda-intel" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard mouse synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="es es_ES en_US" USERLAND="GNU" VIDEO_CARDS="nvidia nv"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

Comment 24 Petteri Räty (RETIRED) gentoo-dev 2009-02-16 17:02:25 UTC
amd64,x86: Are you lacking hardware to test? I can mail you a bluetooth adapter or trustees are quite likely to sponsor if needed.
Comment 25 Pacho Ramos gentoo-dev 2009-02-17 08:14:03 UTC
(In reply to comment #24)
> amd64,x86: Are you lacking hardware to test? I can mail you a bluetooth adapter
> or trustees are quite likely to sponsor if needed.
> 

I am an AMD64 arch tester and Bluetooth works fine with these since months on my amd64 system (sorry, but my x86 doesn't have bluetooth adapter):

Portage 2.1.6.4 (default/linux/amd64/2008.0/desktop, gcc-4.1.2, glibc-2.8_p20080602-r1, 2.6.28-tuxonice-r1 x86_64)
=================================================================
System uname: Linux-2.6.28-tuxonice-r1-x86_64-Intel-R-_Core-TM-2_Duo_CPU_T9300_@_2.50GHz-with-glibc2.2.5
Timestamp of tree: Sat, 14 Feb 2009 20:10:13 +0000
distcc 3.0 x86_64-pc-linux-gnu [disabled]
ccache version 2.4 [enabled]
app-shells/bash:     3.2_p39
dev-java/java-config: 2.1.6-r1
dev-lang/python:     2.5.2-r7
dev-util/ccache:     2.4-r7
dev-util/cmake:      2.4.8
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.63
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.2
sys-devel/binutils:  2.18-r3
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.27-r2
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=nocona -fomit-frame-pointer"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/config /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo /etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-O2 -pipe -march=nocona -fomit-frame-pointer"
DISTDIR="/usr/distfiles"
FEATURES="autoaddcvs ccache collision-protect cvs distlocks fixpackages multilib-strict parallel-fetch protect-owned sandbox sfperms strict unmerge-orphans userfetch"
GENTOO_MIRRORS="ftp://ftp.free.fr/mirrors/ftp.gentoo.org"
LANG="es_ES.UTF-8"
LC_ALL="es_ES.UTF-8"
LDFLAGS="-Wl,-O1"
LINGUAS="es es_ES en_US"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage/layman/sunrise /usr/local/portage/layman/wschlich-testing /usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X a52 aac acl acpi alsa amd64 amr avahi bash-completion berkdb bluetooth branding bzip2 cairo cdda cddb cdparanoia cdr cli consolekit cracklib crypt css cups daap dbus dell dirac divx djvu dts dvd dvdr dvdread dvi eds emboss emovix encode epiphany evo exif fam fbcondecor fbsplash ffmpeg flac fortran fuse galago gdbm gif glitz gmedia gnome gnome-keyring gpm gsm gstreamer gtk hal iconv ieee1394 ipv6 isdnlog java java6 jpeg jpeg2k kdeenablefinal kdehiddenvisibility kpathsea laptop latex lcms ldap libnotify lzma mad midi mikmod mjpeg mmx mmxext mono moonlight mp3 mpeg mudflap multilib musepack musicbrainz nautilus ncurses network network-cron networkmanager nls nptl nptlonly ntp ogg opengl openmp pam pch pcre pdf perl png ppds pppd python qt3 qt3support qt4 quicktime readline realmedia reflection scanner schroedinger sdl session smp sms speex spell spl sse sse2 sse3 ssl ssse3 startup-notification svg sysfs t1lib tcpd theora threads tiff totem truetype unicode usb v4l2 vcd vorbis wmf wmp x264 xattr xcb xft xinetd xml xorg xulrunner xv xvid zeroconf zlib" ALSA_CARDS="hda-intel" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard mouse synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="es es_ES en_US" USERLAND="GNU" VIDEO_CARDS="nvidia nv"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

Comment 26 Markus Meier gentoo-dev 2009-02-17 23:09:06 UTC
(In reply to comment #24)
> amd64,x86: Are you lacking hardware to test? I can mail you a bluetooth adapter
> or trustees are quite likely to sponsor if needed.

my amd64 laptop has a bluetooth adaptor - but I haven't gotten it running yet.
I'll have some time next week, probably you can help me set it up...
Comment 27 Petteri Räty (RETIRED) gentoo-dev 2009-02-25 12:42:03 UTC
Could you please do this as the current stable has problems compiling with current stable according to bug reports.
Comment 28 Ferris McCormick (RETIRED) gentoo-dev 2009-02-25 13:17:50 UTC
Why are the trustees on this?
Comment 29 Markus Meier gentoo-dev 2009-02-25 20:54:14 UTC
(In reply to comment #28)
> Why are the trustees on this?

see comment #24
Comment 30 Gilles Dartiguelongue gentoo-dev 2009-02-28 11:15:36 UTC
*** Bug 260491 has been marked as a duplicate of this bug. ***
Comment 31 Daniel Gryniewicz (RETIRED) gentoo-dev 2009-03-02 21:31:40 UTC
amd64 done.
Comment 32 Markus Meier gentoo-dev 2009-03-08 01:37:02 UTC
x86 stable
Comment 33 Pierre-Yves Rofes (RETIRED) gentoo-dev 2009-03-11 19:03:37 UTC
glsa request filed.
Comment 34 Pierre-Yves Rofes (RETIRED) gentoo-dev 2009-03-16 21:39:24 UTC
GLSA 200903-29