CVE-2005-2547

Published: Aug 12, 2005Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

security.c in hcid for BlueZ 2.16, 2.17, and 2.18 allows remote attackers to execute arbitrary commands via shell metacharacters in the Bluetooth device name when invoking the PIN helper.

Affected (1)

Products: Bluez Project: Bluez

Bluez Project

1 product

Bluez

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Bluez Project Bluez	Version 2.18

References (16)

http://cvs.sourceforge.net/viewcvs.py/bluez/utils/hcid/security.c?r1=1.31&r2=1.34

Source: cve@mitre.org

Patch

http://secunia.com/advisories/16453

Source: cve@mitre.org

http://secunia.com/advisories/16476

Source: cve@mitre.org

http://sourceforge.net/mailarchive/forum.php?thread_id=7893206&forum_id=1881

Source: cve@mitre.org

PatchVendor Advisory

http://www.debian.org/security/2005/dsa-782

Source: cve@mitre.org

http://www.gentoo.org/security/en/glsa/glsa-200508-09.xml

Source: cve@mitre.org

http://www.securityfocus.com/bid/14572

Source: cve@mitre.org

https://bugs.gentoo.org/show_bug.cgi?id=101557

Source: cve@mitre.org

PatchVendor Advisory

http://cvs.sourceforge.net/viewcvs.py/bluez/utils/hcid/security.c?r1=1.31&r2=1.34