Description
hidd in BlueZ (bluez-utils) before 2.25 allows remote attackers to obtain control of the (1) Mouse and (2) Keyboard Human Interface Device (HID) via a certain configuration of two HID (PSM) endpoints, operating as a server, aka HidAttack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | bluez-utils +1 | 2.10-2.2 | RHSA-2007:0065 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- BlueZ 1.x/2.x - HIDD Bluetooh HID Command Injection EDB-29471 · remote · Nov 16, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2007:0065 Red Hat Security Advisory: bluez-utils security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://events.ccc.de/congress/2006-mediawiki//images/f/fb/23c3_Bluetooh_revisited.pdf
- 32830 vdb-entry
- RHSA-2007:0065 vendor-advisory
- 20070104 23C3 - Bluetooth hacking revisted [Summary and Code] mailing-list
- ADV-2007-0200 vdb-entry
- 23798 third-party-advisory
- 22076 vdb-entry
- oval:org.mitre.oval:def:10208 vdb-entry signature
- http://mulliner.org/bluetooth/hidattack.php
- 23879 third-party-advisory
- USN-413-1 vendor-advisory
- MDKSA-2007:014 vendor-advisory
- 25264 third-party-advisory
- 23747 third-party-advisory