CVE-2018-10910

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-10910
A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.

3.3 /10

CVSS v3 : LOW

V3 Legend

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10910 Exploit Issue Tracking Patch Third Party Advisory
https://usn.ubuntu.com/3856-1/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:bluez:bluez:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
History

13 Feb 2023, 04:51

Type Values Removed Values Added
Summary A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable.
CWE NVD-CWE-noinfo CWE-863
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1606203', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1606203', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2018-10910', 'name': 'https://access.redhat.com/security/cve/CVE-2018-10910', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:1101', 'name': 'https://access.redhat.com/errata/RHSA-2020:1101', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2020:1912', 'name': 'https://access.redhat.com/errata/RHSA-2020:1912', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 16:18

Type Values Removed Values Added
Summary A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication. Versions before bluez 5.51 are vulnerable. A bug in Bluez may allow for the Bluetooth Discoverable state being set to on when no Bluetooth agent is registered with the system. This situation could lead to the unauthorized pairing of certain Bluetooth devices without any form of authentication.
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1606203 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2018-10910 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:1101 -
  • (MISC) https://access.redhat.com/errata/RHSA-2020:1912 -
Information

Published : 2019-01-28 15:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-10910

Mitre link : CVE-2018-10910

CVE.ORG link : CVE-2018-10910

JSON object : View

Products Affected

canonical

  • ubuntu_linux

bluez

  • bluez
CWE
CWE-863

Incorrect Authorization

NVD-CWE-noinfo