Overview
Texas Instruments CC2640 and CC2650 microcontrollers are vulnerable to a heap overflow and may allow unauthenticated firmware installation.
Description
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2018-16986 - also known as BLEEDINGBIT
CVE-2018-7080 - also known as BLEEDINGBIT The following Texas Instruments devices are affected if the Over the Air firmware Download (OAD) feature is enabled and not sufficiently secured:
|
Impact
Using a specially crafted set of packets, an attacker can both control the data of the overflow, and the length of it, which may lead to remote code execution on the targeted BLE chip. An attacker needs to be within physical proximity to the device while it is in scanning mode to trigger vulnerable code. This memory corruption can lead to code execution on the main CPU of the device, which could have the potential to affect other devices across a network if the origin is a networked device. An attacker could also exploit this vulnerability to rewrite the operating system of a device and gain full control over it. |
Solution
Update the BLE-Stack |
Vendor Information
Aruba Networks Affected
Notified: October 12, 2018 Updated: October 19, 2018
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Cisco Affected
Notified: October 12, 2018 Updated: November 02, 2018
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Texas Instruments Affected
Notified: October 19, 2018 Updated: October 19, 2018
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Apple Not Affected
Notified: October 12, 2018 Updated: October 30, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Brocade Communication Systems Not Affected
Notified: October 12, 2018 Updated: October 19, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Check Point Software Technologies Not Affected
Notified: October 12, 2018 Updated: October 22, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
D-Link Systems, Inc. Not Affected
Notified: October 12, 2018 Updated: October 19, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Debian GNU/Linux Not Affected
Notified: October 12, 2018 Updated: October 19, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Netgear, Inc. Not Affected
Notified: October 12, 2018 Updated: October 19, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Synology Not Affected
Notified: October 12, 2018 Updated: October 19, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Toshiba Commerce Solutions Not Affected
Notified: October 12, 2018 Updated: October 19, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Zyxel Not Affected
Notified: October 12, 2018 Updated: November 02, 2018
Status
Not Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
3com Inc Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
A10 Networks Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
ACCESS Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
ADTRAN Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
ANTlabs Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
ARRIS Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
ASP Linux Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
AT&T Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
AVM GmbH Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Actelis Networks Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Actiontec Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Aerohive Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
AhnLab Inc Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
AirWatch Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Akamai Technologies, Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Alcatel-Lucent Enterprise Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Amazon Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Android Open Source Project Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Appgate Network Security Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Arch Linux Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Arista Networks, Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
AsusTek Computer Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Atheros Communications Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Avaya, Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Barracuda Networks Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Belkin, Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Bell Canada Enterprises Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
BlueCat Networks, Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Broadcom Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
CA Technologies Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Cambium Networks Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Ceragon Networks Inc Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Comcast Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Command Software Systems Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
CoreOS Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Cradlepoint Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Dell Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Dell EMC Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Dell SecureWorks Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
DesktopBSD Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Deutsche Telekom Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Devicescape Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Digi International Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
DragonFly BSD Project Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
EfficientIP SAS Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Ericsson Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Espressif Systems Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
European Registry for Internet Domains Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Express Logic Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
F-Secure Corporation Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
F5 Networks, Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Fastly Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Fedora Project Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Force10 Networks Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Foundry Brocade Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
FreeBSD Project Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
GNU glibc Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Geexbox Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Gentoo Linux Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Google Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
HP Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
HTC Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
HardenedBSD Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Hitachi Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Honeywell Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Huawei Technologies Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
IBM Corporation (zseries) Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
IBM, INC. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
InfoExpress, Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Infoblox Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Intel Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Internet Systems Consortium Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Internet Systems Consortium - DHCP Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Interniche Technologies, inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Joyent Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Juniper Networks Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Lantronix Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Lenovo Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Linksys Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Marvell Semiconductors Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
McAfee Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
MediaTek Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Medtronic Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Men & Mice Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
MetaSwitch Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Micro Focus Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Microchip Technology Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Microsoft Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
MikroTik Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Miredo Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Mitel Networks, Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
NEC Corporation Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
NETSCOUT Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
NLnet Labs Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
NetBSD Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Nixu Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Nokia Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Nominum Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
OmniTI Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
OpenBSD Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
OpenConnect Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
OpenDNS Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Openwall GNU/*/Linux Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Paessler Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Peplink Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Philips Electronics Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
PowerDNS Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Pulse Secure Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
QLogic Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
QNX Software Systems Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
QUALCOMM Incorporated Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Quagga Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Quantenna Communications Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Red Hat, Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Riverbed Technologies Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Roku Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Ruckus Wireless Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
SUSE Linux Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Samsung Mobile Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Samsung Semiconductor Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Secure64 Software Corporation Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Slackware Linux Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Snort Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
SonicWall Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Sonos Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Sony Corporation Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Sophos, Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Sourcefire Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Symantec Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
TP-LINK Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Technicolor Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
TippingPoint Technologies Inc. Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
TrueOS Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Turbolinux Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Ubuntu Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Unisys Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
VMware Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Wind River Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Xilinx Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Zebra Technologies Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
Zephyr Project Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
aep NETWORKS Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
dnsmasq Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
eero Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
m0n0wall Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
netsnmp Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
pfSense Unknown
Notified: October 12, 2018 Updated: October 12, 2018
Status
Unknown
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
We are not aware of further vendor information regarding this vulnerability.
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 7.9 | AV:A/AC:M/Au:N/C:C/I:C/A:C |
| Temporal | 6.2 | E:POC/RL:OF/RC:C |
| Environmental | 4.6 | CDP:N/TD:M/CR:ND/IR:ND/AR:ND |
References
- http://software-dl.ti.com/lprf/ble_stack/exports/release_notes_BLE_Stack_2_2_2.html
- https://cwe.mitre.org/data/definitions/119.html
- https://armis.com/bleedingbit/
- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-006.txt
- http://dev.ti.com/tirex/content/simplelink_cc2640r2_sdk_2_30_00_28/docs/blestack/ble_user_guide/html/ble3-stack-oad/index-ble3-cc2640.html
Acknowledgements
We would like to thank Ben Seri at Armis for reporting this vulnerability.
This document was written by Madison Oliver.
Other Information
| CVE IDs: | CVE-2018-16986, CVE-2018-7080 |
| Date Public: | 2018-11-01 |
| Date First Published: | 2018-11-01 |
| Date Last Updated: | 2019-01-07 19:17 UTC |
| Document Revision: | 70 |