Information Disclosure Vulnerability in BlueZ SDP Server
CVE-2017-1000250

6.5MEDIUM

Key Information:

Vendor

Bluez

Status
Bluez
Vendor
CVE Published:
12 September 2017

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 38%

What is CVE-2017-1000250?

The SDP server in BlueZ versions up to 5.46 has been found vulnerable to an information disclosure flaw that permits remote attackers to extract sensitive information from the memory of the bluetoothd process. This weakness arises during the handling of SDP search attribute requests, making it essential for users and administrators to review their systems and apply recommended security measures to mitigate potential exploitation.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2017-1000250-PoC
Created by olav-st

References

https://access.redhat.com/security/vulnerabilities/blueborne
x_refsource_CONFIRM
https://www.armis.com/blueborne
x_refsource_MISC
http://www.debian.org/security/2017/dsa-3972
vendor-advisoryx_refsource_DEBIAN

EPSS Score

38% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2017-1000250 : Information Disclosure Vulnerability in BlueZ SDP Server