CVE-2008-2374

2008-07-0723:41:00

CWE-1284

[email protected]

web.nvd.nist.gov

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.4

Confidence

High

EPSS

0.009

Percentile

82.5%

JSON

src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.

Affected configurations

Nvd

Node

bluezbluez-libsRange<3.34

bluezbluez-utilsRange<3.34

Node

fedoraprojectfedoraMatch8

fedoraprojectfedoraMatch9

VendorProductVersionCPE
bluezbluez-libs*cpe:2.3:a:bluez:bluez-libs:*:*:*:*:*:*:*:*
bluezbluez-utils*cpe:2.3:a:bluez:bluez-utils:*:*:*:*:*:*:*:*
fedoraprojectfedora8cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
fedoraprojectfedora9cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bluez	bluez-libs	*	cpe:2.3:a:bluez:bluez-libs::::::::
bluez	bluez-utils	*	cpe:2.3:a:bluez:bluez-utils::::::::
fedoraproject	fedora	8	cpe:2.3:o:fedoraproject:fedora:8:::::::*
fedoraproject	fedora	9	cpe:2.3:o:fedoraproject:fedora:9:::::::*