BlueMirror mesh attacks - CVE-2020-26556, CVE-2020-26557, CVE-2020-26559, CVE-2020-26560

Debian Bug report logs - #1006406
BlueMirror mesh attacks - CVE-2020-26556, CVE-2020-26557, CVE-2020-26559, CVE-2020-26560

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Ben Hutchings <ben@decadent.org.uk>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: BlueMirror mesh attacks - CVE-2020-26557, CVE-2020-26559, CVE-2020-26560

Date: Fri, 25 Feb 2022 03:25:56 +0100

Source: bluez
Severity: important
Tags: security upstream
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

Several of the BlueMirror attacks described at
<https://kb.cert.org/vuls/id/799380> involve mesh provisioning, which
seems to implemented entirely in Bluez user-space.

CVE-2020-26556 was already fixed in 5.50-1.1, but I don't see any
mention of the other issues in either the Debian changelog or upstream
commit messages.

I've intentionally not specified a package version because I don't
know whether the current version has been fixed or not.

Ben.

-- System Information:
Debian Release: bookworm/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'oldstable-updates'), (500, 'unstable'), (500, 'oldstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.15.0-3-amd64 (SMP w/2 CPU threads)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Message #10 received at 1006406@bugs.debian.org (full text, mbox, reply):

From: Ben Hutchings <ben@decadent.org.uk>

To: 1006406@bugs.debian.org

Subject: Re: BlueMirror mesh attacks - CVE-2020-26557, CVE-2020-26559, CVE-2020-26560

Date: Fri, 25 Feb 2022 03:31:58 +0100

[Message part 1 (text/plain, inline)]

Control: retitle -1 BlueMirror mesh attacks - CVE-2020-26556, CVE-2020-26557, CVE-2020-26559, CVE-2020-26560

On Fri, 2022-02-25 at 03:25 +0100, Ben Hutchings wrote:
> CVE-2020-26556 was already fixed in 5.50-1.1, but I don't see any
> mention of the other issues in either the Debian changelog or upstream
> commit messages.

Oops, that was CVE-2020-0556.  So the status of all the mesh
provisioning issues is still unclear.

Ben.

-- 
Ben Hutchings
Beware of bugs in the above code;
I have only proved it correct, not tried it. - Donald Knuth

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.