Bug 25969 - bluez possible new security issue(s) fixed upstream (including CVE-2018-10910 and CVE-2020-0556)
Summary: bluez possible new security issue(s) fixed upstream (including CVE-2018-10910...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2019-12-27 03:57 CET by David Walser
Modified: 2020-04-03 00:49 CEST (History)
6 users (show)

See Also:
Source RPM: bluez-5.50-5.mga7.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2019-12-27 03:57:56 CET
Fedora has issued an advisory on November 13:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/RLZUCXXSKY5T73XN3MMNBCFSJ7XJ44VH/

It doesn't explicitly highlight the security issue(s) fixed, but it sounds like any security issues fixed may actually be in libell and/or iwd, which Fedora has separate packages (and advisories) for.  Perhaps those are bundled components in our build, however.
Comment 1 Lewis Smith 2019-12-27 11:07:37 CET
> security issues fixed may actually be in libell and/or iwd
I cannot find anything like these either in bluez dependencies nor our SRPMs.
Admit to being lost when it comes to relating libraries to SRPMs.

Assigning globally, CC DavidG as recent committer.

Assignee: bugsquad => pkg-bugs
CC: (none) => geiger.david68210, lewyssmith

Comment 2 David Walser 2020-03-13 17:56:49 CET
Apparently there are more security fixes upstream, post-5.53:
https://www.openwall.com/lists/oss-security/2020/03/12/4
https://www.openwall.com/lists/oss-security/2020/03/13/2

Whiteboard: (none) => MGA7TOO
Summary: bluez possible new security issue(s) fixed upstream in 5.52 => bluez possible new security issue(s) fixed upstream in 5.52 and later

Comment 3 David Walser 2020-03-31 22:20:46 CEST
(In reply to David Walser from comment #2)
> Apparently there are more security fixes upstream, post-5.53:
> https://www.openwall.com/lists/oss-security/2020/03/12/4
> https://www.openwall.com/lists/oss-security/2020/03/13/2

This got CVE-2020-0556 and fixed upstream in 5.54.

Debian and Ubuntu have issued advisories for this on March 26 and 30:
https://www.debian.org/security/2020/dsa-4647
https://usn.ubuntu.com/4311-1/

They both added the same 4 patches to 5.50 (which we have).

We can either add those patches and ignore Comment 0 or upgrade to 5.54.

Source RPM: bluez-5.50-6.mga8.src.rpm => bluez-5.50-5.mga7.src.rpm
Version: Cauldron => 7
Summary: bluez possible new security issue(s) fixed upstream in 5.52 and later => bluez possible new security issue(s) fixed upstream in 5.52 and later (including CVE-2020-0556)
Status comment: (none) => Fixed upstream in 5.54
Whiteboard: MGA7TOO => (none)

Comment 4 David Walser 2020-04-01 16:06:21 CEST
RedHat has issued an advisory on March 31:
https://access.redhat.com/errata/RHSA-2020:1101

This issue was fixed upstream in 5.51.

Summary: bluez possible new security issue(s) fixed upstream in 5.52 and later (including CVE-2020-0556) => bluez possible new security issue(s) fixed upstream (including CVE-2018-10910 and CVE-2020-0556)

Comment 5 Nicolas Salguero 2020-04-01 22:14:48 CEST
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable. (CVE-2018-10910)

Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enable escalation of privilege and denial of service via adjacent access. (CVE-2020-0556)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10910
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0556
https://www.openwall.com/lists/oss-security/2020/03/12/4
https://www.openwall.com/lists/oss-security/2020/03/13/2
https://www.debian.org/security/2020/dsa-4647
https://usn.ubuntu.com/4311-1/
https://access.redhat.com/errata/RHSA-2020:1101
========================

Updated packages in core/updates_testing:
========================
bluez-5.54-1.mga7
bluez-cups-5.54-1.mga7
bluez-hid2hci-5.54-1.mga7
lib(64)bluez3-5.54-1.mga7
lib(64)bluez-devel-5.54-1.mga7

from SRPMS:
bluez-5.54-1.mga7.src.rpm

CC: (none) => nicolas.salguero
Assignee: pkg-bugs => qa-bugs
Status: NEW => ASSIGNED

David Walser 2020-04-01 22:43:33 CEST

Status comment: Fixed upstream in 5.54 => (none)

Comment 6 Herman Viaene 2020-04-02 13:54:57 CEST
MGA7-64 Plasma on Lenovo B50
No installation issues
Switched bluetooth on on my smartphone, usedsPlasma systemsettings to setup bluetooth here and the connection process worked. The laptop is also visible in the smartphone.
Turned to dolphin - Network - Bluetooth and there I see the smartphone. opening it gives an icon "Send file", but clicking on that throws an error.
This seems to be a known issue, see https://bugs.kde.org/show_bug.cgi?id=409179
Tried to do the same thing via the Bluetooth applet on the panel, the "Send file" gives no feedback, but I do not see anything appearing in the smartphone "Received files".
At least the connection seems to be there, that's as far as I go.

Whiteboard: (none) => MGA7-64-OK
CC: (none) => herman.viaene

Lewis Smith 2020-04-02 14:43:34 CEST

CC: lewyssmith => (none)

Comment 7 Thomas Andrews 2020-04-02 17:20:05 CEST
Validating. Advisory in Comment 5.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Thomas Backlund 2020-04-03 00:23:01 CEST

CC: (none) => tmb
Keywords: (none) => advisory

Comment 8 Mageia Robot 2020-04-03 00:49:55 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0152.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.