Google Android CVE-2017-0783 Man in the Middle Spoofing Vulnerability

Bugtraq ID:	100811
Class:	Unknown
CVE:	CVE-2017-0783
Remote:	Yes
Local:	No
Published:	Sep 12 2017 12:00AM
Updated:	Sep 12 2017 12:00AM
Credit:	Ben Seri and Gregory Vishnepolsky of Armis
Vulnerable:	Google Pixel XL 0 Google Pixel C 0 Google Pixel 0 Google Nexus Player 0 Google Nexus 9 Google Nexus 6P Google Nexus 6 Google Nexus 5X Google Android 7.1.1 Google Android 6.0.1 Google Android 5.1.1 Google Android 5.0.2 Google Android 4.4.4 Google Android 8.0 Google Android 7.1.2 Google Android 7.0 Google Android 6.0
Not Vulnerable:

Google Android CVE-2017-0783 Man in the Middle Spoofing Vulnerability

Google Android is prone to a security vulnerability that may allow attackers to conduct spoofing attacks.

An attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible.

This issue is being tracked by Android Bug ID A-63145701.

Google Android CVE-2017-0783 Man in the Middle Spoofing Vulnerability

Researchers who discovered this issue have created a proof-of-concept. Please see the references for more information.

Google Android CVE-2017-0783 Man in the Middle Spoofing Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Google Android CVE-2017-0783 Man in the Middle Spoofing Vulnerability

References:

• Android Homepage (Google)
  
• The dangers of Bluetooth implementations: Unveiling zero day vulnerabilities (Ben Seri ??& Gregory Vishnepolsky)
  
• The IoT Attack Vector �??BlueBorne�?� Exposes Almost Every Connected Device (Armis)
  
• Android Security Bulletin�??September 2017 (Google)
  
• VU#240311 Multiple Bluetooth implementation vulnerabilities affect many devices (CERT)