[Bug 246819] [NEW] [CVE-2008-2374] Vulnerability in the SDP client functionality in BlueZ

[Alexander Konovalenko]

*** This bug is a security vulnerability ***

Public security bug reported:

CVE-2008-2374 description:

"src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34
and bluez-utils before 3.34 versions, does not validate string length
fields in SDP packets, which allows remote SDP servers to cause a denial
of service or possibly have unspecified other impact via a crafted
length field that triggers excessive memory allocation or a buffer over-
read."

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2374

** Affects: bluez-libs (Ubuntu)
     Importance: Undecided
         Status: New

** Affects: bluez-utils (Ubuntu)
     Importance: Undecided
         Status: New

** Visibility changed to: Public

** Also affects: bluez-utils (Ubuntu)
   Importance: Undecided
       Status: New

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2008-2374

-- 
[CVE-2008-2374] Vulnerability in the SDP client functionality in BlueZ
https://bugs.launchpad.net/bugs/246819
You received this bug notification because you are a member of
Bluetooth, which is subscribed to bluez-utils in ubuntu.