Upstream information

CVE-2020-15238 at MITRE

Description

Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injection vulnerability. The impact highly depends on the system configuration. If Polkit-1 is disabled and for versions lower than 2.0.6, any local user can possibly exploit this. If Polkit-1 is enabled for version 2.0.6 and later, a possible attacker needs to be allowed to use the `org.blueman.dhcp.client` action. That is limited to users in the wheel group in the shipped rules file that do have the privileges anyway. On systems with ISC DHCP client (dhclient), attackers can pass arguments to `ip link` with the interface name that can e.g. be used to bring down an interface or add an arbitrary XDP/BPF program. On systems with dhcpcd and without ISC DHCP client, attackers can even run arbitrary scripts by passing `-c/path/to/script` as an interface name. Patches are included in 2.1.4 and master that change the DhcpClient D-Bus method(s) to accept BlueZ network object paths instead of network interface names. A backport to 2.0(.8) is also available. As a workaround, make sure that Polkit-1-support is enabled and limit privileges for the `org.blueman.dhcp.client` action to users that are able to run arbitrary commands as root anyway in /usr/share/polkit-1/rules.d/blueman.rules.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 6.9
Vector AV:L/AC:M/Au:N/C:C/I:C/A:C
Access Vector Local
Access Complexity Medium
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
CVSS v3 Scores
  National Vulnerability Database
Base Score 7
Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1178196 [NEW]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub 15 SP2
  • blueman >= 2.1.4-bp152.2.6.1
  • blueman-lang >= 2.1.4-bp152.2.6.1
  • thunar-sendto-blueman >= 2.1.4-bp152.2.6.1
 Patchnames:
openSUSE-2020-1997
openSUSE-2020-2024
openSUSE Leap 15.2
  • blueman >= 2.1.4-lp152.2.3.1
  • blueman-lang >= 2.1.4-lp152.2.3.1
  • thunar-sendto-blueman >= 2.1.4-lp152.2.3.1
 Patchnames:
openSUSE-2020-1997
openSUSE Tumbleweed
  • blueman >= 2.2.1-1.2
  • blueman-lang >= 2.2.1-1.2
  • caja-extension-sendto-blueman >= 2.2.1-1.2
  • nautilus-extension-sendto-blueman >= 2.2.1-1.2
  • nemo-extension-sendto-blueman >= 2.2.1-1.2
  • thunar-sendto-blueman >= 2.2.1-1.2
 Patchnames:
openSUSE Tumbleweed GA blueman-2.2.1-1.2

SUSE Timeline for this CVE

CVE page created: Tue Oct 27 14:23:43 2020
CVE page last modified: Tue May 23 15:34:27 2023