Apple Mac OS X with Bluetooth enabled may allow file exchange without prompting users

Overview

Apple Mac OS X with Bluetooth support may unintentionally allow files to be exchanged with other systems by default.

Description

Mac OS X includes support for the Bluetooth networking protocol suite. Bluetooth is a communication technology that enables short-range communication between devices.

The default Bluetooth settings in OS X may allow files to be exchanged with other devices unknowingly. The default location for files that are exchanged may also be used by other applications, resulting in unintended information disclosure.

---

Impact

Remote attackers may be able to exchange files with a Bluetooth-enabled system running Mac OS X, resulting in unintended information disclosure.

---

Solution

Apply An Update

Apple has addressed the issue in Security Update 2005-005.

---

As a workaround, users can manually disable the Bluetooth file sharing service or change the default location used for file transfers.

---

Vendor Information

258390

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Apple Computer Inc. __ Affected

Updated: May 05, 2005

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Apple has addressed the issue in Security Update 2005-005.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23258390 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://docs.info.apple.com/article.html?artnum=301528&gt;
• <http://secunia.com/advisories/15227/&gt;
• <http://www.digitalmunition.com/DMA[2005-0502a].txt&gt;

Acknowledgements

Thanks to Apple Product Security for reporting this vulnerability, who in turn credit Kevin Finisterre with reporting the issue.

This document was written by Ken MacInnis.

Other Information

CVE IDs:	CVE-2005-1332
Severity Metric:	2.03 Date Public: