CVE-2008-2374: Input Validation
src/sdp.c in bluez-libs 3.30 in BlueZ, and other bluez-libs before 3.34 and bluez-utils before 3.34 versions, does not validate string length fields in SDP packets, which allows remote SDP servers to cause a denial of service or possibly have unspecified other impact via a crafted length field that triggers excessive memory allocation or a buffer over-read.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2374?
CVE-2008-2374 has a severity rating that indicates it could lead to denial of service due to improper validation of string length fields.
How do I fix CVE-2008-2374?
To fix CVE-2008-2374, update to BlueZ libraries version 3.34 or later as it contains the necessary security patches.
Which versions of BlueZ are affected by CVE-2008-2374?
CVE-2008-2374 affects BlueZ versions prior to 3.34, including all versions up to and including 3.30.
Can CVE-2008-2374 be exploited remotely?
Yes, CVE-2008-2374 can be exploited remotely by sending crafted SDP packets to vulnerable services.
What are the potential impacts of CVE-2008-2374?
The potential impacts of CVE-2008-2374 include denial of service and possibly other unspecified impacts due to unvalidated input.