CVE-2008-2374

Published Jul 7, 2008

Last updated 9 months ago

Overview

Description: src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.
Source: secalert@redhat.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-1284

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:bluez:bluez-libs:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E07F4288-8279-44F6-A0CA-CBBAB38B9CC0",
            "versionEndExcluding": "3.34"
          },
          {
            "criteria": "cpe:2.3:a:bluez:bluez-utils:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1DF2F11E-16A5-40DF-9D61-886FFFD1834D",
            "versionEndExcluding": "3.34"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "72E4DB7F-07C3-46BB-AAA2-05CD0312C57F"
          },
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "743CBBB1-C140-4FEF-B40E-FAE4511B1140"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References