UBUNTU-CVE-2018-5383
Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.
02 / AFFECTED SOFTWARE
Affected packages
65 explicit affected versions
23 explicit affected versions
31 explicit affected versions
29 explicit affected versions
10 explicit affected versions
1 explicit affected versions
33 explicit affected versions
1 explicit affected versions
1 explicit affected versions
1 explicit affected versions
18 explicit affected versions
33 explicit affected versions
28 explicit affected versions
10 explicit affected versions
34 explicit affected versions
9 explicit affected versions
27 explicit affected versions
1 explicit affected versions
6 explicit affected versions
23 explicit affected versions
11 explicit affected versions
67 explicit affected versions
29 explicit affected versions
34 explicit affected versions
95 explicit affected versions
41 explicit affected versions
1 explicit affected versions
1 explicit affected versions
54 explicit affected versions
12 explicit affected versions
30 explicit affected versions
26 explicit affected versions
26 explicit affected versions
75 explicit affected versions
54 explicit affected versions
9 explicit affected versions
21 explicit affected versions
11 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.
05 / REFERENCES
Further evidence
- http://www.cs.technion.ac.il/~biham/BT/
- https://ubuntu.com/security/CVE-2018-5383
- https://ubuntu.com/security/notices/USN-4094-1
- https://ubuntu.com/security/notices/USN-4095-1
- https://ubuntu.com/security/notices/USN-4095-2
- https://ubuntu.com/security/notices/USN-4118-1
- https://ubuntu.com/security/notices/USN-4351-1
- https://www.cve.org/CVERecord?id=CVE-2018-5383
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00128.html