The vulnerability of the Bluetooth BR/EDR encryption key negotiation protocol, which stems from the use of cryptographic algorithms with defects, allows a perpetrator to carry out a “man-in-the-middle” attack, interfering with the encryption setup process for BR/EDR connections and reducing the length of the encryption key used.

🗓️ 30 Aug 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

Bluetooth key negotiation vulnerability enables remote man-in-the-middle and shorter encryption keys due to flawed algorithms.

Reporter	Title	Published	Views	Family All 300
GithubExploit	Exploit for Use of a Broken or Risky Cryptographic Algorithm in Google Android	15 Aug 201911:54	–	githubexploit
GithubExploit	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Google Android	21 Mar 202607:17	–	githubexploit
Android Security Bulletins	Android Security Bulletin—August 2019Stay organized with collectionsSave and categorize content based on your preferences.	5 Aug 201900:00	–	androidsecurity
Android Security Bulletins	Pixel Update Bulletin—August 2019Stay organized with collectionsSave and categorize content based on your preferences.	5 Aug 201900:00	–	androidsecurity
Apple	About the security content of macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra	22 Jul 201900:00	–	apple
Apple	About the security content of watchOS 5.3	22 Jul 201900:00	–	apple
Apple	About the security content of tvOS 12.4	22 Jul 201900:00	–	apple
Apple	About the security content of iOS 12.4	22 Jul 201900:00	–	apple
Apple	About the security content of iOS 12.4 - Apple Support	25 Jun 202007:44	–	apple
Apple	About the security content of macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra - Apple Support	25 Jun 202007:44	–	apple

Vulners

Node

OR

bluetooth_special_interest_group bluetooth_br/edrRange≤5.1

cisco_systems cisco_small_business_ip_phonesMatch7.6.4

Source	Link
bugzilla	www.bugzilla.kernel.org/show_bug.cgi
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
kb	www.kb.cert.org/vuls/id/918987/
kernel	www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.133
kernel	www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.58
kernel	www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.185
kernel	www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.185
kernel	www.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.17
knobattack	www.knobattack.com/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-9506

31 May 2024 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 27.8

CVSS 38.1

EPSS0.02691

Bluetooth encryption man in the middle cryptographic weaknesses remote attacker encryption key length encryption setup vulnerability exploitation