Microsoft Bluetooth Driver Spoofing Vulnerability
CVE-2017-8628 is fixed in 20 products on 1 platform, first by KB4025337, released July 11, 2017. It is not reported as exploited. Patch Radar priority: High.
<p>A spoofing vulnerability exists in Microsoft's implementation of the Bluetooth stack. An attacker who successfully exploited this vulnerability could perform a <a href="https://technet.microsoft.com/en-us/library/security/dn848375.aspx#MiTM">man-in-the-middle attack</a> and force a user's computer to unknowingly route traffic through the attacker's computer. The attacker can then monitor and read the traffic before sending it on to the intended recipient.</p> <p>To exploit the vulnerability, the attacker needs to be within the physical proximity of the targeted user, and the user's computer needs to have Bluetooth enabled. The attacker can then initiate a Bluetooth connection to the target computer without the user's knowledge.</p> <p>The security update addresses the vulnerability by correcting how Windows handles Bluetooth requests.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Microsoft | |||
| Windows 10 Version 1511 for 32-bit Systems | 10586.1106 | KB4038783 | Sep 12, 2017 |
| Windows 10 Version 1511 for x64-based Systems | 10586.1106 | KB4038783 | Sep 12, 2017 |
| Windows 10 Version 1607 for 32-bit Systems | 14393.1715 | KB4038782 | Sep 12, 2017 |
| Windows 10 Version 1607 for x64-based Systems | 14393.1715 | KB4038782 | Sep 12, 2017 |
| Windows 10 Version 1703 for 32-bit Systems | 15063.608 | KB4038788 | Sep 12, 2017 |
| Windows 10 Version 1703 for x64-based Systems | 15063.608 | KB4038788 | Sep 12, 2017 |
| Windows 10 for 32-bit Systems | 10240.17609 | KB4038781 | Sep 12, 2017 |
| Windows 10 for x64-based Systems | 10240.17609 | KB4038781 | Sep 12, 2017 |
| Windows 7 for 32-bit Systems Service Pack 1 | KB4038777 | Sep 12, 2017 | |
| Windows 7 for 32-bit Systems Service Pack 1 | KB4025337 | Jul 11, 2017 | |
| Windows 7 for x64-based Systems Service Pack 1 | KB4038777 | Sep 12, 2017 | |
| Windows 7 for x64-based Systems Service Pack 1 | KB4025337 | Jul 11, 2017 | |
| Windows 8.1 for 32-bit systems | KB4038792 | Sep 12, 2017 | |
| Windows 8.1 for 32-bit systems | KB4025333 | Jul 11, 2017 | |
| Windows 8.1 for x64-based systems | KB4038792 | Sep 12, 2017 | |
| Windows 8.1 for x64-based systems | KB4025333 | Jul 11, 2017 | |
| Windows RT 8.1 | KB4038792 | Sep 12, 2017 | |
| Windows Server 2008 for 32-bit Systems Service Pack 2 | KB4034786 | Sep 26, 2017 | |
| Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | KB4034786 | Sep 26, 2017 | |
| Windows Server 2008 for Itanium-Based Systems Service Pack 2 | KB4034786 | Sep 26, 2017 | |
| Windows Server 2008 for x64-based Systems Service Pack 2 | KB4034786 | Sep 26, 2017 | |
| Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | KB4034786 | Sep 26, 2017 | |
| Windows Server 2016 | 14393.1715 | KB4038782 | Sep 12, 2017 |
| Windows Server 2016 (Server Core installation) | 14393.1715 | KB4038782 | Sep 12, 2017 |