SUSE-SU-2019:2710-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-18595: A double free may be caused by the function allocatetracebuffer in the file kernel/trace/trace.c bnc1149555. - CVE-2019-14821: An out-of-bounds...

SUSE-SU-2019:2706-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2019-15291: There was a NULL pointer dereference, caused by a malicious USB device in the flexcopusbprobe function in the drivers/media/usb/b2c2/flexcop-usb.c...

August 13, 2019—KB4512517 (OS Build 14393.3144)

None None...

Code injection

Nespresso Prodigio devices lack Bluetooth connection security...

On the IoT road: perks, benefits and security of moving smartly

Kaspersky has repeatedly investigated security issues related to IoT technologies for instance, here, or here. Earlier this year our experts have even gained foothold in the security of biomechanical prosthetic devices. The same implies to smart car security: our own research has indicated that...

June 11, 2019—KB4503327 (OS Build 17763.557)

None None...

June 11, 2019—KB4503293 (OS Build 18362.175)

None None...

CVE-2019-12500

The CVE-2019-12500 entry concerns the Xiaomi M365 scooter. The vulnerability is rooted in Bluetooth Low Energy commands lacking server-side authentication, enabling spoofing of critical controls such as a sudden acceleration, braking, locking, and unlocking. Affected firmware is prior to 1.5.1. D...

CVE-2018-9540

The CVE-2018-9540 issue affects Android’s Bluetooth stack. In avrc_ctrl_pars_vendor_rsp (avrc_pars_ct.c) a missing bounds check allows an out-of-bounds read, enabling remote information disclosure over Bluetooth without user interaction or added privileges. Affected: Android 7.0–9 (Android-7.0, 7...

Google 'Titan Security Key' Is Now On Sale For $50

Google just made its Titan Security Key available on its store for $50. First announced last month at Google Cloud Next '18 convention, Titan Security Key is a tiny USB device—similar to Yubico's YubiKey—that offers hardware-based two-factor authentication 2FA for online accounts with the highest...

Tips for safe summer travels: your cybersecurity checklist

Summer is just around the corner in the Northern Hemisphere, and with it comes vacation plans for many. Those looking to take some time away from work and home are likely making plans to secure their home, have their pets taken care of, and tie up loose ends at work. But how about securing your...

‘Hacking’ the Nespresso Prodigio and Jura E8 coffee machines

You’ll probably know by now that I have a particular interest in the security of IoT coffee machines and tea kettles. Sometimes security is so poor that we have to laugh. Such simple security issues. Now, when I’m feeling lazy and possibly a bit hung over, I really can’t be bothered to make coffe...

CVE-2018-9119

An attacker with physical access to a BrilliantTS FUZE card MCU firmware 0.1.73, BLE firmware 0.7.4 can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool...

Android Bluetooth - BNEP bnep_data_ind() Remote Heap Disclosure

import os import sys import struct import bluetooth BNEPPSM = 15 BNEPFRAMECOMPRESSEDETHERNET = 0x02 LEAKATTEMPTS = 20 def leaksrcbdaddr, dst: bnep = bluetooth.BluetoothSocketbluetooth.L2CAP bnep.settimeout5 bnep.bindsrcbdaddr, 0 print 'Connecting to BNEP...' bnep.connectdst, BNEPPSM...

SUSE-SU-2018:0268-1 Security update for the Linux Kernel (Live Patch 18 for SLE 12 SP1)

This update for the Linux Kernel 3.12.74-606451 fixes several issues. The following security issues were fixed: - CVE-2017-15868: The bnepaddconnection function in net/bluetooth/bnep/core.c in did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a...

BlueMaho v090417 - Bluetooth Security Testing Suite

BlueMaho is GUI-shell interface for suite of tools for testing security of bluetooth devices. It is freeware, opensource, written on python, uses wxPyhon. It can be used for testing BT-devices for known vulnerabilities and major thing to do - testing to find unknown vulns. Also it can form nice...

A week in security (September 25 – October 01)

Recently, we talked about the hacking incident at Deloitte, one of the 'big four' global accounting firms. It was reported that client email addresses, usernames, and passwords were exposed. This also brought to light weaknesses in their policies and lack of threat intelligence to recover leaked...

MGASA-2017-0350 Updated bluez packages fix security vulnerability

An information-disclosure flaw was found in the bluetoothd implementation of the Service Discovery Protocol SDP. A specially crafted Bluetooth device could, without prior pairing or user interaction, retrieve portions of the bluetoothd process memory, including potentially sensitive information...

Oracle Linux 6 / 7 : bluez (ELSA-2017-2685)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2685 advisory. 4.66-2 - sdpd heap fixes Resolves: 1490008 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

Recommended update for chromium (important)

Chromium was updated to 53.0.2785.113 to fix a number of security issues and bugs. The following vulnerabilities were fixed: - CVE-2016-5170: Use after free in Blink - CVE-2016-5171: Use after free in Blink - CVE-2016-5172: Arbitrary Memory Read in v8 - CVE-2016-5173: Extension resource access -...