cnvd - cnvd-2016-10458

CNVD-2016-10458

Vulnerability from cnvd - Published: 2016-11-01

Title

TrackR Bravo信息泄露漏洞

Description

TrackR Bravo是一款蓝牙物品防丢器。 TrackR Bravo存在信息泄露漏洞，攻击者可利用漏洞获得敏感信息。

Severity

中

Formal description

目前没有详细的解决方案提供： https://www.thetrackr.com/bravo

Reference

http://www.securityfocus.com/bid/93874

Impacted products

Name
TrackR Bravo

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "93874"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-6539"
    }
  },
  "description": "TrackR Bravo\u662f\u4e00\u6b3e\u84dd\u7259\u7269\u54c1\u9632\u4e22\u5668\u3002\r\n\r\nTrackR Bravo\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u83b7\u5f97\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "Deral Heiland and Adam Compton of Rapid7, Inc.",
  "formalWay": "\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u89e3\u51b3\u65b9\u6848\u63d0\u4f9b\uff1a\r\nhttps://www.thetrackr.com/bravo",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-10458",
  "openTime": "2016-11-01",
  "products": {
    "product": "TrackR Bravo"
  },
  "referenceLink": "http://www.securityfocus.com/bid/93874",
  "serverity": "\u4e2d",
  "submitTime": "2016-10-28",
  "title": "TrackR Bravo\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2016-6539 (GCVE-0-2016-6539)

Vulnerability from cvelistv5 – Published: 2018-07-06 21:00 – Updated: 2024-08-06 01:36

Summary

The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541.

Severity ?

No CVSS data available.

CWE

CWE-200 - Information Exposure

Assigner

certcc

References

URL

Tags

	http://www.securityfocus.com/bid/93874	vdb-entryx_refsource_BID
	https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ	x_refsource_MISC
	https://blog.rapid7.com/2016/10/25/multiple-bluet…	x_refsource_MISC
	https://www.kb.cert.org/vuls/id/617567	third-party-advisoryx_refsource_CERT-VN

Impacted products

Vendor

Product

Version

TrackR

Bravo Mobile Application

Unaffected: 5.1.6

TrackR

Bravo Mobile Application

Unaffected: 2.2.5

Credits

Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:36:27.350Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "93874",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93874"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/"
          },
          {
            "name": "VU#617567",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/617567"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "iOS"
          ],
          "product": "Bravo Mobile Application",
          "vendor": "TrackR",
          "versions": [
            {
              "status": "unaffected",
              "version": "5.1.6"
            }
          ]
        },
        {
          "platforms": [
            "Android"
          ],
          "product": "Bravo Mobile Application",
          "vendor": "TrackR",
          "versions": [
            {
              "status": "unaffected",
              "version": "2.2.5"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability."
        }
      ],
      "datePublic": "2016-10-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-07-07T09:57:01",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "name": "93874",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93874"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/"
        },
        {
          "name": "VU#617567",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/617567"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2016-6539",
          "STATE": "PUBLIC",
          "TITLE": "TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Bravo Mobile Application",
                      "version": {
                        "version_data": [
                          {
                            "affected": "!",
                            "platform": "iOS",
                            "version_affected": "!",
                            "version_value": "5.1.6"
                          },
                          {
                            "affected": "!",
                            "platform": "Android",
                            "version_affected": "!",
                            "version_value": "2.2.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "TrackR"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200: Information Exposure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "93874",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93874"
            },
            {
              "name": "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ",
              "refsource": "MISC",
              "url": "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ"
            },
            {
              "name": "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/",
              "refsource": "MISC",
              "url": "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/"
            },
            {
              "name": "VU#617567",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/617567"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2016-6539",
    "datePublished": "2018-07-06T21:00:00",
    "dateReserved": "2016-08-03T00:00:00",
    "dateUpdated": "2024-08-06T01:36:27.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2016-10458

CVE-2016-6539 (GCVE-0-2016-6539)

Tags

Sightings

Nomenclature