Rapid7 Vulnerability & Exploit Database

Microsoft CVE-2019-9506: Encryption Key Negotiation of Bluetooth Vulnerability

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

Microsoft CVE-2019-9506: Encryption Key Negotiation of Bluetooth Vulnerability

Severity
5
CVSS
(AV:A/AC:L/Au:N/C:P/I:P/A:N)
Published
08/13/2019
Created
08/14/2019
Added
08/13/2019
Modified
11/18/2021

Description

Executive Summary Microsoft is aware of the Bluetooth BR/EDR (basic rate/enhanced data rate, known as "Bluetooth Classic") key negotiation vulnerability that exists at the hardware specification level of any BR/EDR Bluetooth device. An attacker could potentially be able to negotiate the offered key length down to 1 byte of entropy, from a maximum of 16 bytes. To exploit this vulnerability, an attacker would need specialized hardware and would be limited by the range of the Bluetooth devices in use. Using this specialized equipment, they would need to be close enough to communicate and interfere with the legitimate transmissions being made wirelessly. CERT/CC has issued CVE-2019-9506 and VU#918987 for this tampering vulnerability, which has a CVSS score of 9.3. To address the vulnerability Microsoft has released a software update that enforces a default 7-octet minimum key length to ensure that the key negotiation does not trivialize the encryption. This functionality is disabled by default when the update is installed. Customers must enable this functionality by setting a specific flag in the registry. When the flag is set, Windows software will read the encryption key size and reject the Bluetooth connection if it does not meet the defined minimum key size. If your particular Bluetooth device or the Bluetooth radio in your Windows device, or the driver for that Bluetooth radio does not support the longer key length, this update could block connections with that device when the registry key EnableMinimumEncryptionKeySize is set to a value of 1. Users who have issues connecting their Bluetooth devices after installing and enabling this functionality should check to see if their manufacturer is providing additional guidance on updates and mitigations. To enable this enforcement feature by using Registry Editor, follow these steps: Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Click Start, click Run, type Regedit in the Open box, and then click OK. Locate and then click the following registry subkey: HKLM\System\CurrentControlSet\Policies\Hardware\Bluetooth On the Edit menu, click Modify to modify the EnableMinimumEncryptionKeySize registry entry. In the Value data box, type 1, and then click OK. This sets the "EnableMinimumEncryptionKeySize"=dword value to 00000001 Exit Registry Editor. Restart the computer. You then need to reset your Bluetooth device as follows: On the device, go to the Bluetooth Settings. Turn off Bluetooth. Open the Device Manager and locate the Bluetooth Controller. Right-click on the Bluetooth Controller and select Disable device. After the device is disabled, right-click again and select Enable device. Computers with incompatible Bluetooth controllers or devices may have to temporarily or permanently set EnableMinimumEncryptionKeySize = 0 until controllers, firmware or drivers can be updated or the device itself updated. Bluetooth connections on computers in this state will not be secure. To disable this enforcement feature: Click Start, click Run, type Regedit in the Open box, and then click OK. Locate and then click the following registry subkey: HKLM\System\CurrentControlSet\Policies\Hardware\Bluetooth On the Edit menu, click Modify to modify the EnableMinimumEncryptionKeySize registry entry. In the Value data box, type 1, and then click OK. This sets the "EnableMinimumEncryptionKeySize"=dword value to 00000000 Exit Registry Editor. Restart the computer. You then need to follow the preceeding instructions for resetting your Bluetooth device. Recommended Actions The best protection is to keep computers up to date. Please see Microsoft Knowledge Base Article 4514157 for guidance on protecting Windows devices. If your particular device does not support the longer key length, this update could block connections with that device. Users who have issues connecting their Bluetooth devices after installing and enabling this functionality should check to see if their manufacturer is providing additional guidance on updates and mitigations. FAQ 1. Why is this enforcement not enabled by default? A number of devices may not currently be able to support a longer key length and would not function with this fix enabled. Combined with the difficulty to use this attack and the need of specialized equipment and proximity to the target, this was decided to be left disabled initially to avoid any compatibility issues. The choice to enable this functionality would be left up to the user. 2. Where can I find more information about enabling this functionality? If you determine that you need to enable this functionality to enforce a default 7-octet minimum key length, see Microsoft Knowledge Base Article 4514157. References Thank you to ICASI for coordinating multi-vendor response. Also see Statement from the International Consortium for Advancement of Cybersecurity on the Internet (ICASI) on the Bluetooth Vulnerability CERT/CC VU#918987 See Bluetooth SIG advisory: https://www.bluetooth.com/security/statement-key-negotiation-of-bluetooth

Solution(s)

  • msft-kb4511553-8eb289e2-ef30-46de-a545-1600b9255165
  • msft-kb4511553-9cdd3e34-499b-4c72-9be8-74f6946a1830
  • msft-kb4511553-c33e7db5-e128-4ca0-aa51-fcd3fd32bcb2
  • msft-kb4512482-5ed85e60-5ce7-4c4c-94aa-f19944914692
  • msft-kb4512482-68a99d81-d48f-4437-9515-ea4a427f4014
  • msft-kb4512482-69a5f449-ad8a-42a5-a815-014c374a7293
  • msft-kb4512486-16bba1d9-7035-4243-b78b-cea3df5096b6
  • msft-kb4512486-2d01b298-6879-4d30-8a68-e872592d343e
  • msft-kb4512486-437934f0-2915-4e74-b1cc-04921ce3aef1
  • msft-kb4512486-cb62a71d-be6d-491e-9e4d-046e3dff67e9
  • msft-kb4512486-d6348d13-661b-4391-b03d-77cbf3143cd2
  • msft-kb4512486-fc466b63-7e33-42b7-8bfe-72335a76bb07
  • msft-kb4512489-90af280c-d27d-450d-a8de-81ca67856fc0
  • msft-kb4512489-b3966674-69a0-477b-a7cf-038bf6d6bf58
  • msft-kb4512489-bfc44f53-1c17-46df-9be6-9009a1a38c70
  • msft-kb4512497-6dbe32fb-5832-4dac-8ec8-31c4b0651e31
  • msft-kb4512497-d8fdba67-9336-4531-bc67-4d7eedc79b4f
  • msft-kb4512501-5570183b-a0b7-4478-b0af-47a6e65417ca
  • msft-kb4512501-d45c0b6d-99f1-4b6e-b7a0-2fbaa7335985
  • msft-kb4512501-e1c03faa-adc1-4068-97c4-089a33cb5add
  • msft-kb4512507-84eb119c-d9c4-487f-b45a-0b8188a2d270
  • msft-kb4512507-a50734e7-f388-46dd-b697-513537829ae3
  • msft-kb4512508-2b24eae0-5ba4-438f-bdae-7ed8347e2718
  • msft-kb4512508-35cff443-e9f5-4d0a-a8fc-7fe8a39ab515
  • msft-kb4512508-d4a24678-720e-4e4b-87d6-aa3ae8fceebc
  • msft-kb4512516-5909e402-b1ec-4dc4-8648-d73a81a115aa
  • msft-kb4512516-646eec92-7205-48d6-9a66-ba080e2824ed
  • msft-kb4512517-081388ab-f979-4aef-93fe-813c0044c838
  • msft-kb4512517-4a96dbb7-bbf9-4813-9bfe-b84b252fcaa7
  • msft-kb4512517-af89cf2e-ce74-4a9e-b16d-070888bce28c

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;