CVE-2019-9506

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

Link	Resource
https://www.bluetooth.com/security/statement-key-negotiation-of-bluetooth/	Third Party Advisory
https://www.usenix.org/conference/usenixsecurity19/presentation/antonioli	Third Party Advisory
http://www.cs.ox.ac.uk/publications/publication12404-abstract.html	Third Party Advisory
https://www.kb.cert.org/vuls/id/918987/	Third Party Advisory US Government Resource
http://seclists.org/fulldisclosure/2019/Aug/13	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2019/Aug/14	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2019/Aug/11	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2019/Aug/15	Mailing List Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190828-01-knob-en	Third Party Advisory
https://usn.ubuntu.com/4115-1/	Third Party Advisory
https://usn.ubuntu.com/4118-1/	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00014.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00015.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html	Mailing List Third Party Advisory
https://usn.ubuntu.com/4147-1/	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2975	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html	Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3055	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3076	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3089	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3187	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3217	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3218	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3165	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3220	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3231	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3309	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3517	Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0204	Third Party Advisory

Configuration 1

cpe:2.3:o:apple:mac_os_x:10.12.6:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.13.6:*:*:*:*:*:*:* cpe:2.3:o:apple:watchos:5.3:*:*:*:*:*:*:* cpe:2.3:o:apple:iphone_os:12.4:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.14.5:*:*:*:*:*:*:* cpe:2.3:o:apple:tvos:12.4:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_real_time:7:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:7:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_tus:7.6:*:*:*:*:*:*:* cpe:2.3:a:redhat:mrg_realtime:2.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_real_time:8:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_real_time_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_real_time_eus:8.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv_eus:8.2:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization_host_eus:4.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_aus:7.5:*:*:*:*:*:*:*

---

Published : 2019-08-14 05:15

Updated : 2021-11-04 03:58

---

NVD link : CVE-2019-9506

Mitre link : CVE-2019-9506

Huawei

Sydneym-l23 Firmware

CWE-327