<![CDATA[[security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix?]]>Here's some news link:

https://arstechnica.com/information-technology/2017/09/bluetooth-bugs-open-billions-of-devices-to-attacks-no-clicking-required/

Ubuntu CVE pages:

https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000251.html

https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-1000250.html

]]>https://forums.ubports.com/topic/548/security-solved-can-we-get-blueborne-bluetooth-vulnerabilities-fixed-in-ota-2-or-ota-1-hotfixRSS for NodeFri, 15 May 2026 07:01:09 GMTWed, 13 Sep 2017 18:52:31 GMT60<![CDATA[Reply to [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix? on Thu, 16 Nov 2017 18:53:39 GMT]]>@Talkless Had forgotten mine are now on RC channel not stable and updated to r14 yesterday. Or am I getting mixed up with things and OTA's.

]]>https://forums.ubports.com/post/5439https://forums.ubports.com/post/5439Thu, 16 Nov 2017 18:53:39 GMT<![CDATA[Reply to [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix? on Thu, 16 Nov 2017 17:50:12 GMT]]>@Lakota said in [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix?:

@Talkless Thanks for clearing that up. Wasn't sure only read your comments after yesterday OT A's.

Uhm, what do you mean "after yesterday OT A's" ?

It will be fixed on OTA-3, if I understood correctly, which is not yet released AFAIK.

]]>https://forums.ubports.com/post/5438https://forums.ubports.com/post/5438Thu, 16 Nov 2017 17:50:12 GMT<![CDATA[Reply to [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix? on Thu, 16 Nov 2017 17:32:44 GMT]]>@Talkless Thanks for clearing that up. Wasn't sure only read your comments after yesterday OT A's.

]]>https://forums.ubports.com/post/5437https://forums.ubports.com/post/5437Thu, 16 Nov 2017 17:32:44 GMT<![CDATA[Reply to [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix? on Thu, 16 Nov 2017 16:58:22 GMT]]>@Lakota said in [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix?:

@Talkless Are they todays OTA's or future ones. Thanks

"next OTA", the future one.

]]>https://forums.ubports.com/post/5436https://forums.ubports.com/post/5436Thu, 16 Nov 2017 16:58:22 GMT<![CDATA[Reply to [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix? on Wed, 15 Nov 2017 19:08:40 GMT]]>@Talkless Are they todays OTA's or future ones. Thanks

]]>https://forums.ubports.com/post/5418https://forums.ubports.com/post/5418Wed, 15 Nov 2017 19:08:40 GMT<![CDATA[Reply to [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix? on Wed, 15 Nov 2017 18:15:14 GMT]]>From Community Update 15:

People have been asking about the KRACK and BlueBorne vulnerabilities lately, and for good reason. These are highly public explots. Both have been fixed in the RC and Devel channels, with the fixes landing in Stable with the next OTA.

]]>https://forums.ubports.com/post/5411https://forums.ubports.com/post/5411Wed, 15 Nov 2017 18:15:14 GMT<![CDATA[Reply to [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix? on Wed, 04 Oct 2017 19:05:38 GMT]]>This issue has already been fixed in the hammerhead kernel via this commit. I believe a pull from the upstream Fairphone kernel fixed it, too, but I'll need to get confirmation.

This fix has not been released to anything but the devel channel.

]]>https://forums.ubports.com/post/4696https://forums.ubports.com/post/4696Wed, 04 Oct 2017 19:05:38 GMT<![CDATA[Reply to [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix? on Wed, 04 Oct 2017 04:20:17 GMT]]>Ok, I've studied the CVE and the patches, and I'm pretty sure I can get this applied for the kernel source net/bluetooth/l2cap_core.c, at least on hammerhead. I can take a similar look if somebody can tell me how to check out the source which includes src/sdpd-request.c.

]]>https://forums.ubports.com/post/4687https://forums.ubports.com/post/4687Wed, 04 Oct 2017 04:20:17 GMT<![CDATA[Reply to [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix? on Wed, 27 Sep 2017 18:28:10 GMT]]>@Flohack FYI, probably just got attacked at the local Cafe. Turned on BT for my external keyboard, but keyboard typing was locked up, then an authentication dialog box popped up. I shut the device down ASAP, will do a clean install since God knows what got scribbled.

No BT in public for me until this is fixed!

]]>https://forums.ubports.com/post/4524https://forums.ubports.com/post/4524Wed, 27 Sep 2017 18:28:10 GMT<![CDATA[Reply to [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix? on Thu, 14 Sep 2017 20:10:23 GMT]]>@Flohack I am with you,on the not delaying part,I am near retirement,I want to see you guys take over the world before ~~~~~

]]>https://forums.ubports.com/post/4098https://forums.ubports.com/post/4098Thu, 14 Sep 2017 20:10:23 GMT<![CDATA[Reply to [security][solved] Can we get BlueBorne (Bluetooth vulnerabilities) fixed in OTA-2 or OTA-1 hotfix? on Thu, 14 Sep 2017 16:11:03 GMT]]>To be honest: We cannot do this so fast. We are a small team, and the patches we are talking here about need to be backported probably, which creates chance to introduce new errors, or in worst case new security flaws. The CVE 250 is fixed in Bluez, which means we could try to upgrade to a newer version in the same moment.

The CVE 251 is a kernel patch, which is really painful, we would need to backport it to various 3.x kernel versions, which are all more or less end of life already. maybe someone can take a look if Android is backporting this for the older devices.

Until we want to delay OTA-2 further to an unknown date I suggest releasing it without these patches, and make a hotfix later.

BR

]]>https://forums.ubports.com/post/4095https://forums.ubports.com/post/4095Thu, 14 Sep 2017 16:11:03 GMT