CVE-2020-12860

COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE device can have four roles and COVIDSafe uses all of them. This allows for re-identification of a device, and potentially identification of the owner's name...

Design/Logic Flaw

COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE device can have four roles and COVIDSafe uses all of them. This allows for re-identification of a device, and potentially identification of the owner's name...

CVE-2020-12860

COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE device can have four roles and COVIDSafe uses all of them. This allows for re-identification of a device, and potentially identification of the owner's name...

CVE-2020-12860

CVE-2020-12860 concerns the COVIDSafe app (v1.0.17) where a BLE stack design allows a remote attacker to access phone name and model information by enabling four roles on a single device. The vulnerability enables potential device re-identification and exposure of the owner’s name as described ac...

CVE-2020-12860: Improper Privilege Management

COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE device can have four roles and COVIDSafe uses all of them. This allows for re-identification of a device, and potentially identification of the owner's name...

Bluetooth devices supporting LE and specific BR/EDR implementations are vulnerable to method confusion attacks

Overview Bluetooth Low Energy BLE and Basic Rate / Enhanced Data Rate BR/EDR Core Configurations are used for low-power short-range communications. To establish an encrypted connection, two Bluetooth devices must pair with each other using an agreed upon Association Model. It is possible for an...

PT-2020-13305

Name of the Vulnerable Software and Affected Versions COVIDSafe versions through v1.0.17 Description The issue allows a remote attacker to access phone name and model information. This is possible because a BLE device can have four roles and COVIDSafe uses all of them, enabling re-identification ...

Short beacon analysis on the NHS iOS Tracking application

We recently helped the BBC with a piece on the new NHS COVID-19 tracking application. Concerns were raised by some about the ability for the app to track interactions while it was running in the background. There had been some discussion that suggested two iOS devices running the app whilst...

CVE-2019-13916

CVE-2019-13916 affects Cypress/WICED Studio 6.2 on CYW20735B1 and CYW20819A1. A BLE packet received is copied into a heap (ThreadX Block) buffer; the dhmulp_getRxBuffer allocation is four bytes too small for the max 255 bytes plus headers. This can corrupt a pointer in the g_mm_BLEDeviceToHostPoo...

CVE-2019-13916: Out-of-bounds Write

An issue was discovered in Cypress formerly Broadcom WICED Studio 6.2 CYW20735B1 and CYW20819A1. As a Bluetooth Low Energy BLE packet is received, it is copied into a Heap ThreadX Block buffer. The buffer allocated in dhmulpgetRxBuffer is four bytes too small to hold the maximum of 255 bytes plus...

CVE-2020-0059

In btmblebatchscanfiltertrackadvvsecback of btmblebatchscan.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2020-11425

Name of the Vulnerable Software and Affected Versions Android versions Android-10 Description The issue is related to a possible out of bounds read in the btm ble batchscan filter track adv vse cback function of btm ble batchscan.cc. This could lead to local information disclosure without requiri...

CVE-2019-19192

The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle consecutive Attribute Protocol ATT requests on reception, allowing attackers in radio range to cause an event deadlock or crash via crafted packets...

CVE-2019-16336

The Bluetooth Low Energy implementation in Cypress PSoC 4 BLE component 3.61 and earlier processes data channel frames with a payload length larger than the configured link layer maximum RX payload size, which allows attackers in radio range to cause a denial of service crash via a crafted BLE Li...

Design/Logic Flaw

The Bluetooth Low Energy implementation in Cypress PSoC 4 BLE component 3.61 and earlier processes data channel frames with a payload length larger than the configured link layer maximum RX payload size, which allows attackers in radio range to cause a denial of service crash via a crafted BLE Li...

CVE-2019-16336

CVE-2019-16336 affects Cypress PSoC 4 BLE component versions up to 3.61. The BLE Link Layer processes data channel frames where the payload length exceeds the configured RX payload size, enabling an attacker within radio range to trigger a denial of service (crash) via a crafted BLE Link Layer fr...

CVE-2019-19194

The Bluetooth Low Energy Secure Manager Protocol SMP implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x through 3.3 devices installs a zero long term key LTK if an out-of-order link-layer encryption request...

CVE-2019-19196

The Bluetooth Low Energy Secure Manager Protocol SMP implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x through 3.3 devices accepts a pairing request with a key size greater than 16 bytes, allowing an...

Buffer overflow

The Bluetooth Low Energy Secure Manager Protocol SMP implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x through 3.3 devices accepts a pairing request with a key size greater than 16 bytes, allowing an...

Design/Logic Flaw

The Bluetooth Low Energy Secure Manager Protocol SMP implementation on Telink Semiconductor BLE SDK versions before November 2019 for TLSR8x5x through 3.4.0, TLSR823x through 1.3.0, and TLSR826x through 3.3 devices installs a zero long term key LTK if an out-of-order link-layer encryption request...