[NT] Vulnerability in Bluetooth Stack Allows Code Execution (MS08-030)
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 11 Jun 2008 08:20:22 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Vulnerability in Bluetooth Stack Allows Code Execution (MS08-030)
------------------------------------------------------------------------
SUMMARY
This security update resolves a privately reported vulnerability in the
Bluetooth stack in Windows that could allow remote code execution. An
attacker who successfully exploited this vulnerability could take complete
control of an affected system. An attacker could then install programs;
view, change, or delete data; or create new accounts with full user
rights.
This security update is rated Critical for all supported editions of
Windows XP and Windows Vista. For more information, see the subsection,
Affected and Non-Affected Software, in this section.
DETAILS
Affected Software:
*
<http://www.microsoft.com/downloads/details.aspx?familyid=980bb421-950f-4825-8039-44cc961a47b8> Windows XP Service Pack 2 and Windows XP Service Pack 3 - Remote Code Execution - Critical - None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=81ab56ca-933f-4974-a393-290a54c30a78> Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2 - Remote Code Execution - Critical - None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=6524debe-be50-44d1-8543-af0bfaf086ad> Windows Vista and Windows Vista Service Pack 1 - Remote Code Execution - Critical - None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=6adee8b9-3455-4f3b-8bdd-2585c8ff83b8> Windows Vista x64 Edition and Windows Vista x64 Edition Service Pack 1 - Remote Code Execution - Critical - None
Non-Affected Software:
* Microsoft Windows 2000 Service Pack 4
* Windows Server 2003 Service Pack 1 and Windows Server 2003 Service Pack
2
* Windows Server 2003 x64 Edition and Windows Server 2003 x64 Edition
Service Pack 2
* Windows Server 2003 with SP1 for Itanium-based Systems and Windows
Server 2003 with SP2 for Itanium-based Systems
* Windows Server 2008 for 32-bit Systems
* Windows Server 2008 for x64-based Systems
* Windows Server 2008 for Itanium-based Systems
Bluetooth Vulnerability - CVE-2008-1453
A remote code execution vulnerability exists in the Bluetooth stack in
Microsoft Windows because the Bluetooth stack does not correctly handle a
large number of service description requests. The vulnerability could
allow an attacker to run code with elevated privileges. An attacker who
successfully exploited this vulnerability could take complete control of
an affected system. An attacker could then install programs; view, change,
or delete date; or create new accounts with full user rights.
Mitigating Factors for Bluetooth Vulnerability - CVE-2008-1453
Mitigation refers to a setting, common configuration, or general
best-practice, existing in a default state, that could reduce the severity
of exploitation of a vulnerability. The following mitigating factors may
be helpful in your situation:
This vulnerability only affects systems with Bluetooth capability.
Workarounds for Bluetooth Vulnerability - CVE-2008-1453
Workaround refers to a setting or configuration change that does not
correct the underlying vulnerability but would help block known attack
vectors before you apply the update. Microsoft has tested the following
workarounds and states in the discussion whether a workaround reduces
functionality.
* Prevent the computer from accepting new Bluetooth connections
Interactive Method
1. On the Control Panel, select Classic View.
2. Select Bluetooth Devices.
3. Click the Options tab.
4. Clear the Allow Bluetooth devices to find this computer checkbox.
5. Click OK.
How to undo the workaround
1. On the Control Panel, select Classic View.
2. Select Bluetooth Devices.
3. Click the Options tab.
4. Select the Allow Bluetooth devices to find this computer checkbox.
5. Click OK.
PowerShell Script Method
Run the following commands as an elevated administrator:
$BthDriverKeys = Get-ChildItem "HKLM:\System\CurrentControlSet\Enum\usb"
-recurse -ErrorAction SilentlyContinue | where {$_.GetValue("Service") -eq
"BTHUSB"}
foreach($Key in $BthDriverKeys) { Set-ItemProperty -Path
$Key.OpenSubKey("Device Parameters").Name.Replace("HKEY_LOCAL_MACHINE",
"HKLM:") -Name "Write Scan Enable" -Value 0 }
How to undo the workaround
Run the following commands as an elevated administrator:
$BthDriverKeys = Get-ChildItem "HKLM:\System\CurrentControlSet\Enum\usb"
-recurse -ErrorAction SilentlyContinue | where {$_.GetValue("Service") -eq
"BTHUSB"}
foreach($Key in $BthDriverKeys) { Set-ItemProperty -Path
$Key.OpenSubKey("Device Parameters").Name.Replace("HKEY_LOCAL_MACHINE",
"HKLM:") -Name "Write Scan Enable" -Value 3 }
* Turn off and disable the Bluetooth driver
You can stop and disable the driver by using the following command at the
command prompt (available in Windows XP and above, and in the Windows 2000
Resource Kit):
sc config bthport start= disabled
How to undo the workaround
You can re-enable the Bluetooth driver by using the following command at
the command prompt (available in Windows XP and above and in the Windows
2000 Resource Kit):
sc config bthport start= demand
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1453>
CVE-2008-1453
ADDITIONAL INFORMATION
The information has been provided by Microsoft Product Security.
The original article can be found at:
<http://www.microsoft.com/technet/security/bulletin/ms08-030.mspx>
http://www.microsoft.com/technet/security/bulletin/ms08-030.mspx
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NT] Apple QuickTime PICT Image Parsing Buffer Overflow
- Next by Date: [NEWS] Multiple Vendor FreeType2 Multiple Vulnerabilities
- Previous by thread: [NT] Apple QuickTime PICT Image Parsing Buffer Overflow
- Next by thread: [NEWS] Multiple Vendor FreeType2 Multiple Vulnerabilities
- Index(es):
Relevant Pages
|
