Bug#303501: CAN-2005-0750: Bluetooth root exploit due to boundary checking
Package: kernel-source-2.6.8
Version: 2.6.8-15
Severity: critical
Justification: root security hole
USN-103-1 says this:
> Ilja van Sprundel discovered that the bluez_sock_create() function did
> not check its "protocol" argument for negative values. A local
> attacker could exploit this to execute arbitrary code with root
> privileges by creating a Bluetooth socket with a specially crafted
> protocol number. (CAN-2005-0750)
It's fixed in 2.6.11.6, and the relevant diff can be seen:
http://www.kernel.org/diff/diffview.cgi?file=%2Fpub%2Flinux%2Fkernel%2Fv2.6%2Fincr%2Fpatch-2.6.11.5-6.bz2;z=6
Reply to: