apple ios CVE-2019-9506 vulnerability in Apple and Other Products
Published on August 14, 2019

Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

product logo product logo product logo product logo product logo product logo product logo product logo
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Weakness Type

Cryptographic Issues

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.


Products Associated with CVE-2019-9506

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2019-9506 are published in these products:

Apple iOS
 
Apple macOS
 
Apple tvOS
 
Apple watchOS
 
Canonical Ubuntu Linux
 
Debian Linux
 
OpenSuse Leap
 
Red Hat Mrg Realtime
 
Red Hat Virtualization Host Eus
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Enterprise Linux Aus
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux For Real Time
 
Red Hat Enterprise Linux Real Time Eus
 
Red Hat Enterprise Linux Real Time Nfv
 
Red Hat Enterprise Linux Real Time Nfv Eus
 
Red Hat Enterprise Linux Server
 
Red Hat Enterprise Linux Server Aus
 
Red Hat Enterprise Linux Server Tus
 
Red Hat Enterprise Linux Tus
 

Affected Versions

Bluetooth BR/EDR:

Exploit Probability

EPSS
4.46%
Percentile
88.85%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.