Description
Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net/bluetooth/cmtp/capi.c) in the Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 before 2.6.18.6, and 2.6.19.x, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via CAPI messages with a large value for the length of the (1) manu (manufacturer) or (2) serial (serial number) field.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | hostap-modules-i386 | 1:0.3.7-1sarge3 | DSA-1503-1 |
| Debian 3.1 | i2c | 1:2.9.1-1sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-arm +1 | 2.4.27-2sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-m68k | 2.4.27-3sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-sparc | 2.4.27-9sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-speakup-i386 | 2.4.27-1.1sarge5 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-alpha | 101sarge3 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-i386 | 101sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-s390 | 2.4.27-1sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-sparc | 42sarge3 | DSA-1503-1 |
| Debian 3.1 | kernel-patch-2.4.27-mips | 2.4.27-10.sarge4.040815-3 | DSA-1503-1 |
| Debian 3.1 | kernel-source-2.4.27 +4 | 2.4.27-10sarge6 | DSA-1503-2, DSA-1503-1 |
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge7 | DSA-1304-1 |
| Debian 3.1 | mindi-kernel | 2.4.27-2sarge5 | DSA-1503-1 |
| Debian 3.1 | pcmcia-modules-2.4.27-i386 | 3.2.5+2sarge2 | DSA-1503-1 |
| Debian 3.1 | systemimager | 3.2.3-6sarge5 | DSA-1503-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +8 | 2.6.9-42.0.8.EL | RHSA-2007:0014 |
Advisories 4
- RHSA-2007:0014 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-1503-2 kernel-source-2.4.27 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1503-1 kernelimage-2.4.27 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1304-1 kernel-source-2.6.8 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 2007-0002 vendor-advisory
- 24098 third-party-advisory
- ADV-2006-5037 vdb-entry
- MDKSA-2007:025 vendor-advisory
- 27227 third-party-advisory
- oval:org.mitre.oval:def:10891 vdb-entry signature
- SUSE-SA:2007:053 vendor-advisory
- 23609 third-party-advisory
- RHSA-2007:0014 vendor-advisory
- MDKSA-2007:012 vendor-advisory
- 23593 third-party-advisory
- SUSE-SA:2007:021 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-063.htm
- USN-416-1 vendor-advisory
- 24105 third-party-advisory
- 25226 third-party-advisory
- 23408 third-party-advisory
- 23752 third-party-advisory
- 25683 third-party-advisory
- 24206 third-party-advisory
- 20070209 rPSA-2007-0031-1 kernel mailing-list
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=218602
- 23997 third-party-advisory
- 20070615 rPSA-2007-0124-1 kernel xen mailing-list
- SUSE-SA:2007:018 vendor-advisory
- DSA-1503 vendor-advisory
- 24547 third-party-advisory
- [linux-kernel] 20061219 Linux 2.6.18.6 mailing-list
- MDKSA-2007:002 vendor-advisory
- SUSE-SA:2007:030 vendor-advisory
- 29058 third-party-advisory
- DSA-1304 vendor-advisory
- 25714 third-party-advisory
- kernel-cmtprecvinteropmsg-bo(30912) vdb-entry
- 21604 vdb-entry
- SUSE-SA:2007:035 vendor-advisory
- http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.33.5
- 23427 third-party-advisory
- 25691 third-party-advisory
- https://issues.rpath.com/browse/RPL-848
- [linux-kernel] 20061215 [patch 24/24] Bluetooth: Add packet size checks for CAPI messages (CVE-2006-6106) mailing-list