Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection and accept HID keyboard reports potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

🗓️ 21 Dec 2023 08:00:00Reported by MicrosoftType

BlueZ HID Hosts may allow unauthenticated peripherals to inject HID reports without user action.

Reporter	Title	Published	Views	Family All 229
IBM Security Bulletins	Security Bulletin: Vulnerability in BlueZ affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.	13 Mar 202517:32	–	ibm
GithubExploit	Exploit for Improper Authentication in Google Android	31 May 202617:29	–	githubexploit
GithubExploit	bleak	16 May 202618:42	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	15 Dec 202403:00	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	27 Mar 202513:54	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	20 Dec 202417:28	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	16 Jan 202407:44	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Google Android	8 Jan 202400:20	–	githubexploit
Tenable Nessus	Amazon Linux 2023 : bluez, bluez-cups, bluez-deprecated (ALAS2023-2024-473)	8 Jan 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2 : bluez (ALAS-2020-1504)	28 Oct 202000:00	–	nessus