CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-31615
https://notcve.org/view.php?id=CVE-2021-31615
Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4.0 through 5.2 may permit an adjacent device to inject a crafted packet during the receive window of the listening device before the transmitting device initiates its packet transmission to achieve full MITM status without terminating the link. When applied against devices establishing or using encrypted links, crafted packets may be used to terminate an existing link, but will not compromise the confidentiality or integrity of the link. Los enlaces de banda base de Bluetooth Low Energy sin cifrar en Bluetooth Core Specifications versiones 4.0 hasta 5.2, pueden permitir a un dispositivo adyacente inyectar un paquete diseñado durante la ventana de recepción del dispositivo de escucha antes de que el dispositivo transmisor inicie su transmisión de paquetes para lograr un estado de tipo MITM completo sin terminar el enlace. Cuando se aplica contra dispositivos que establecen o usan enlaces cifrados, los paquetes diseñados pueden ser usados para terminar un enlace existente, pero no comprometerán la confidencialidad o la integridad del enlace • https://bluetooth.com https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/injectable • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.4EPSS: 0%CPEs: 32EXPL: 0CVE-2020-26555 – kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack
https://notcve.org/view.php?id=CVE-2020-26555
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN. Un emparejamiento de código PIN BR/EDR heredado de Bluetooth en Bluetooth Core Specification versiones 1.0B hasta 5.2, puede permitir a un dispositivo cercano no autenticado falsificar el BD_ADDR del dispositivo peer para completar el emparejamiento sin conocer el PIN A vulnerability was found in Linux Kernel, where Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack. When an attacker connects to a victim device using the address of the device and the victim initiates a Pairing, the attacker can reflect the encrypted nonce even without knowledge of the key. • https://kb.cert.org/vuls/id/799380 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html https://access.redhat.com/security/cve/CVE-2020-26555 https://bugzilla.redhat.com/show_bug.cgi?id=1918601 • CWE-400: Uncontrolled Resource Consumption CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-26556
https://notcve.org/view.php?id=CVE-2020-26556
Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently random AuthValue before the provisioning procedure times out, to complete authentication by leveraging Malleable Commitment. Un Mesh Provisioning en el perfil de Bluetooth Mesh versiones 1.0 y 1.0.1, puede permitir a un dispositivo cercano, capaz de conducir un ataque de fuerza bruta con éxito en un AuthValue insuficientemente aleatorio antes de que se agote el tiempo de espera del procedimiento de aprovisionamiento, para completar la autenticación al aprovechar Malleable Commitment • https://kb.cert.org/vuls/id/799380 https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security https://www.kb.cert.org/vuls/id/799380 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 4.3EPSS: 0%CPEs: 34EXPL: 0CVE-2020-26558 – bluez: Passkey Entry protocol of the Bluetooth Core is vulnerable to an impersonation attack
https://notcve.org/view.php?id=CVE-2020-26558
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time. El emparejamiento seguro de Bluetooth LE y BR/EDR en Bluetooth Core Specification versiones 2.1 hasta 5.2, puede permitir a un atacante de tipo man-in-the-middle cercano identificar el Passkey usada durante el emparejamiento (en el procedimiento de autenticación de Passkey) mediante el reflejo de la clave pública y la evidencia de autenticació del dispositivo de inicio, potencialmente permitiendo a este atacante completar el emparejamiento autenticado con el dispositivo que responde usando la contraseña correcta para la sesión de emparejamiento. La metodología de ataque determina el valor de la Clave un bit a la vez A vulnerability was found in the bluez, where Passkey Entry protocol used in Secure Simple Pairing (SSP), Secure Connections (SC) and LE Secure Connections (LESC) of the Bluetooth Core Specification is vulnerable to an impersonation attack where an active attacker can impersonate the initiating device without any previous knowledge. • https://kb.cert.org/vuls/id/799380 https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html https://lists.debian.org/debian-lts-announce/2021/06/msg00022.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ https://security.gentoo.org/glsa/202209-16 https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security ht • CWE-287: Improper Authentication •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15802
https://notcve.org/view.php?id=CVE-2020-15802
Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one transport, either LE or BR/EDR, and replace a bonding already established on the opposing transport, BR/EDR or LE, potentially overwriting an authenticated key with an unauthenticated key, or a key with greater entropy with one with less. Los dispositivos compatibles con Bluetooth versiones anteriores a 5.1, pueden permitir ataques de tipo man-in-the-middle. Cross Transport Key Derivation en Bluetooth Core Specification versiones v4.2 y v5.0, puede permitir a un usuario no autenticado establecer una vinculación con un transporte, ya sea LE o BR/EDR, y reemplazar una vinculación ya establecida en el transporte opuesto, BR/EDR o LE, potencialmente sobrescribiendo una clave autenticada con una clave no autenticada, o una clave con mayor entropía con una con menos • https://gizmodo.com/bluetooth-unveils-its-latest-security-issue-with-no-se-1845013709 https://www.bluetooth.com/learn-about-bluetooth/bluetooth-technology/bluetooth-security/blurtooth https://www.kb.cert.org/vuls/id/589825 • CWE-287: Improper Authentication •