BlueBorne Vulnerabilities Impact Over 5 Billion Bluetooth-Enabled Devices

[Linux-SWAT]

https://mobile.slashdot.org/story/1...pact-over-5-billion-bluetooth-enabled-devices

I've no idea if the Pandora is affected.

 

[klapse]

I searched forums for Bluetooth and didn't see this thread. Sorry.

 

[levi]

You were asking for the Pyra weren't you? The answer here is most likely different, in that I suspect the Pandora is very much still vulnerable to blueborne. I don't personally use bluetooth very often, so I'm not bothered (and never use it when out of the house, which limits the attack surface), but it is something to be aware of I guess. Has anyone checked whether the Pandora uses ASLR yet?

 

[TrashyMG]

I think how manual the Pandora is when it comes with dealing with everything bluetooth I'm not sure how vulnerable the Pandora is.

 

[levi]

From what I can tell, it simply needs bluetooth to be up, which is available on the settings menu widget thing. Judging by the video attacking a tizen watch, you simply point the hack at a bluetooth address, and it gets you into a root shell, by crashing the bluetooth deamon which has root privs, and apparently a buffer overflow bug which lets you write executable code after the end of the buffers and crash the CPU into that new code.

 

[FBnil]

it was in Bluez (Bug is a stack overflow in BlueZ (CVE-2017-1000251), patched already in Debian... so Pyra is good), and bluez4 is in angstrom... so it could be...

Pandora has: bluez4 4.99r13.5

They have not released exploit code (although the demo shows them using blues.py)
Disclosed to Apple and others... but nothing public. So I do not know....

opkg update; opkg list-upgradable does not show a new version yet... (but we have a forked Pandora repository, so that is not very effective).

RedHat is not very helpful: https://access.redhat.com/errata/RHSA-2017:2685

Debian is the same? https://search.debian.org/cgi-bin/omega?DB=en&P=bluez
link to DSA-3972-1 bluez is dead. (although that one is a bug about sniffing more information, not the stack overflow bug)

 

[levi]

I think your redhat link is wrong; it's not the out-of-bound heap read (which could leak sensitive data), it's this stack overflow bug: https://access.redhat.com/errata/RHSA-2017:2679

 

[notaz]

There are multiple bugs, some of them are in the kernel, others in bluez. I can push a kernel update once 3.2 (still supported) backport appears, but with bluez it will be more difficult as (AFAIK) no supported distros use 4.x bluez any more.

 

[levi]

If this 'blues.py' script does ever get leaked, even just fixing one of the holes it relies on will stop any skiddies trying to use it against our Pandoras as I understand it, so an updated kernel would be welcome!

 

[Linux-SWAT]

Thanks for the Zaxxon patch, notaz.
http://git.openpandora.org/cgi-bin/...it;h=92bc15ea0c89b19f0f87964d17fdc46fd1f967a1

 

[comradekingu]

Allegedly the original Bluetooth spread christianity to Denmark.

 

[ible]

truth is stranger than fiction... especially blue-truth.

 

[Linux-SWAT]

So they also spread the Biblue ?

 

[notaz]

Finally published the updates, both kernel and bluez fixes. Would be good if somebody tested if bluetooth still works.

3.2.93 doesn't contain the fix, so I hoped another update would follow soon, but it didn't, however Debian oldoldstable does contain the backported patch, so just applied that.

 

[Linux-SWAT]

Thanks.

 

[levi]

Just upgrading and tested my FC30 8bitdo joypad (in joystick mode, I think), and a ThinkOutside BT keyboard. Both worked without problems (at least once I figured out how to type numbers on that damn keyboard).

And hurrah for the Debian backporters. Looks like a job well done - I haven't tested the exploit, but there are no regressions in normal use that I could find.

Edit: For anyone else testing this, don't forget to reboot after upgrading.