CVE-2018-5383 Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange

2018-08-0721:00:00

CWE-325

certcc

www.cve.org

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

6.1

Confidence

High

EPSS

0.003

Percentile

68.7%

JSON

Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.

CNA Affected

[
  {
    "product": "macOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "10.13.6",
        "status": "affected",
        "version": "10.13 High Sierra",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "iOS",
    "vendor": "Apple",
    "versions": [
      {
        "lessThan": "11.4",
        "status": "affected",
        "version": "11",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Android",
    "vendor": "Android Open Source Project",
    "versions": [
      {
        "lessThan": "2018-06-05 patch level",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]