Debian Bug report logs - #303501
CAN-2005-0750: Bluetooth root exploit due to boundary checking

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Geoff Crompton" <geoffc@strategicdata.com.au>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CAN-2005-0750: Bluetooth root exploit due to boundary checking

Date: Thu, 07 Apr 2005 13:08:21 +1000

Package: kernel-source-2.6.8
Version: 2.6.8-15
Severity: critical
Justification: root security hole

USN-103-1 says this:
> Ilja van Sprundel discovered that the bluez_sock_create() function did
> not check its "protocol" argument for negative values. A local
> attacker could exploit this to execute arbitrary code with root
> privileges by creating a Bluetooth socket with a specially crafted
> protocol number. (CAN-2005-0750) 

It's fixed in 2.6.11.6, and the relevant diff can be seen:
http://www.kernel.org/diff/diffview.cgi?file=%2Fpub%2Flinux%2Fkernel%2Fv2.6%2Fincr%2Fpatch-2.6.11.5-6.bz2;z=6

Message #12 received at 303501@bugs.debian.org (full text, mbox, reply):

From: Matthijs Mohlmann <matthijs@cacholong.nl>

To: 303501@bugs.debian.org

Subject: Re: CAN-2005-0750: Bluetooth root exploit due to boundary checking

Date: Thu, 19 May 2005 15:29:04 +0200

[Message part 1 (text/plain, inline)]

Hi,

It seems that this is fixed in the current kernel (just uploaded)

The patch submitted by this bug seems to be applied already.

Probably forgotten to add to the changelog entry ?

Regards,

Matthijs Mohlmann

[signature.asc (application/pgp-signature, attachment)]

Message #17 received at 303501-done@bugs.debian.org (full text, mbox, reply):

From: muehlenhoff@univention.de (Moritz Mühlenhoff)

To: 303501-done@bugs.debian.org

Subject: This has already been fixed

Date: Mon, 30 May 2005 09:25:10 +0200

Hi,
this bug has already been fixed as part of the 2.6.8-16 upload, but
was not directly closed through the changelog, so I'm closing it now.

Cheers,
         Moritz
-- 
Moritz Muehlenhoff muehlenhoff@univention.de     fon: +49 421 22 232- 0
Development        Linux for Your Business       fax: +49 421 22 232-99
Univention GmbH    http://www.univention.de/   mobil: +49 175 22 999 23

Send a report that this bug log contains spam.