Description
The event_pin_code_request function in the btsrv daemon (btsrv.c) in Nokia Affix 2.1.2 and 3.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a Bluetooth device name.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | affix | 2.1.1-3 | DSA-796-1 |
Advisories 1
- DSA-796-1 affix - unsafe use of popen Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-796 vendor-advisory
- http://affix.sourceforge.net/patch_btsrv_affix_3_2_0
- 14672 vdb-entry
- http://affix.sourceforge.net/patch_btsrv_affix_2_1_2
- 16574 third-party-advisory
- http://www.digitalmunition.com/DMA%5B2005-0826a%5D.txt
- nokia-devicename-command-execution(22034) vdb-entry
- 20050826 DMA[2005-0826a] - 'Nokia Affix Bluetooth btsrv poor use of popen()' mailing-list