CVE-2017-14315: Buffer Overflow
Bluetooth. An input validation issue existed in Bluetooth. This issue was addressed with improved input validation.
Other sources
In Apple iOS 7 through 9, due to a BlueBorne flaw in the implementation of LEAP (Low Energy Audio Protocol), a large audio command can be sent to a targeted device and lead to a heap overflow with attacker-controlled data. Since the audio commands sent via LEAP are not properly validated, an attacker can use this overflow to gain full control of the device through the relatively high privileges of the Bluetooth stack in iOS. The attack bypasses Bluetooth access control; however, the default "Bluetooth On" value must be present in Settings.
Credit
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2017-14315?
CVE-2017-14315 is considered a high-severity vulnerability due to its potential for remote exploitation via Bluetooth.
How do I fix CVE-2017-14315?
To mitigate CVE-2017-14315, update your affected Apple iOS devices to at least version 7.3 or later.
What systems are affected by CVE-2017-14315?
CVE-2017-14315 affects Apple iOS versions ranging from 7.0 to 9.3.5.
What type of vulnerability is CVE-2017-14315?
CVE-2017-14315 is an input validation issue in the Bluetooth protocol that can lead to potential remote code execution.
Can CVE-2017-14315 be exploited remotely?
Yes, CVE-2017-14315 can be exploited remotely by sending specially crafted Bluetooth audio commands to targeted devices.