CVE-2015-8612

HIGH

Blueman <2.0.3 - Privilege Escalation

Title source: llm

Description

The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubylocallinux

https://www.exploit-db.com/exploits/46186

View Code ZIP pw:eip

metasploit WORKING POC EXCELLENT

by Sebastian Krahmer, bcoles · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/blueman_set_dhcp_handler_dbus_priv_esc.rb

View Code ZIP pw:eip

References (10)

[Exploit, Third Party Advisory] http://packetstormsecurity.com/files/135047/Slackware-Security-Advisory-blueman-Updates.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/79688

[Vendor Advisory] http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.421085

[Various Sources] https://twitter.com/thegrugq/status/677809527882813440

[Issue Tracking] https://github.com/blueman-project/blueman/issues/416

[Release Notes] https://github.com/blueman-project/blueman/releases/tag/2.0.3

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/46186/

[Third Party Advisory] http://www.debian.org/security/2015/dsa-3427

[Mailing List] http://www.openwall.com/lists/oss-security/2015/12/18/6

[Mailing List] http://www.openwall.com/lists/oss-security/2015/12/19/1

Scores

CVSS v3 8.4

EPSS 0.2311

EPSS Percentile 95.9%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-264

Status published

Products (1)

blueman_project/blueman < 2.0

Published Jan 08, 2016

Tracked Since Feb 18, 2026