CVE-2019-9506— Bluetooth BR/EDR 加密问题漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

Bluetooth BR/EDR

利用判断

存在公开或 AI PoC，应优先验证

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Bluetooth BR/EDR是一种蓝牙BR/EDR（基本速率/增强数据速率）标准。 Bluetooth BR/EDR 5.1及之前版本中存在加密问题漏洞。该漏洞源于网络系统或产品未正确使用相关密码算法，导致内容未正确加密、弱加密、明文存储敏感信息等。

CVE-2019-9506 影响 Bluetooth BR/EDR。存在公开或 AI PoC，应优先验证。Bluetooth BR/EDR是一种蓝牙BR/EDR（基本速率/增强数据速率）标准。 Bluetooth BR/EDR 5.1及之前版本中存在加密问题漏洞。该漏洞源于网络系统或产品未正确使用相关密码算法，导致内容未正确加密、弱加密、明文存储敏感信息等。 CVE-2019-9506 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2019-9506

一、 漏洞 CVE-2019-9506 基础信息

受影响产品

二、漏洞 CVE-2019-9506 的公开POC

三、漏洞 CVE-2019-9506 的情报信息

CVE-2019-9506 厂商安全公告 (17)

• https://www.kb.cert.org/vuls/id/918987/ third-party-advisory x_refsource_CERT-VN
• https://usn.ubuntu.com/4118-1/ vendor-advisory x_refsource_UBUNTU
• https://usn.ubuntu.com/4147-1/ vendor-advisory x_refsource_UBUNTU
• https://usn.ubuntu.com/4115-1/ vendor-advisory x_refsource_UBUNTU
• https://access.redhat.com/errata/RHSA-2019:3220 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2020:0204 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:3076 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:3089 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:3055 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:3165 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:3517 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:2975 vendor-advisory x_refsource_REDHAT
• 🔗 RHSA-2019:3309 - Security Advisory - Red Hat Customer Portal 查看完整文章 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:3217 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:3187 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:3231 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:3218 vendor-advisory x_refsource_REDHAT

CVE-2019-9506 邮件列表归档 (9)

• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html vendor-advisory x_refsource_SUSE
• https://lists.debian.org/debian-lts-announce/2019/09/msg00025.html mailing-list x_refsource_MLIST
• https://lists.debian.org/debian-lts-announce/2019/09/msg00015.html mailing-list x_refsource_MLIST
• https://lists.debian.org/debian-lts-announce/2019/09/msg00014.html mailing-list x_refsource_MLIST
• http://seclists.org/fulldisclosure/2019/Aug/13 mailing-list x_refsource_FULLDISC
• http://seclists.org/fulldisclosure/2019/Aug/15 mailing-list x_refsource_FULLDISC
• http://seclists.org/fulldisclosure/2019/Aug/14 mailing-list x_refsource_FULLDISC
• http://seclists.org/fulldisclosure/2019/Aug/11 mailing-list x_refsource_FULLDISC

CVE-2019-9506 其他参考 (4)

• http://www.cs.ox.ac.uk/publications/publication12404-abstract.html x_refsource_MISC
• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190828-01-knob-en x_refsource_CONFIRM
• https://www.usenix.org/conference/usenixsecurity19/presentation/antonioli x_refsource_MISC
• https://www.bluetooth.com/security/statement-key-negotiation-of-bluetooth/ x_refsource_CONFIRM

• https://www.cve.org/CVERecord?id=CVE-2019-9506

IV. Related Vulnerabilities

V. Comments for CVE-2019-9506