CVE-2015-3777

Vulnerability

Multiple buffer overflow vulnerabilities exist in blued, the Bluetooth system daemon in Apple OS X, prior to version 10.10.5. These flaws are triggered through XPC messages, which are interprocess communication mechanisms used between system services and applications. A local user can send specially crafted XPC messages to blued, leading to memory corruption.

Exploitation

An attacker must have local access to a vulnerable system (OS X Yosemite v10.10 through v10.10.4 or OS X Mavericks v10.9.5). No remote attack vector is available. The attacker crafts and sends malicious XPC messages to the blued process. No special authentication beyond local user credentials is required if the attacker already has a user account.

Impact

Successful exploitation allows a local attacker to execute arbitrary code in the context of the blued process, which runs with elevated system privileges. This can lead to full compromise of the affected system, including arbitrary code execution with root privileges.

Mitigation

Apple addressed these vulnerabilities in OS X Yosemite v10.10.5 and Security Update 2015-006, released on August 13, 2015 [1]. Users should update to the latest available version. No workaround is provided for unpatched systems. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.