The Patching Friars' AlmanacA calendar of CVE saints

Feast day November 1

BLEEDINGBITHoly card for bleedingbit, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 1 BLEEDINGBIT SANGUIS EX DENTE CAERULEO
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint BLEEDINGBIT, Who Bled Through Bluetooth

Patron of Bluetooth Low Energy chips, enterprise access points, and features nobody remembered switching on.

Life

In November 2018 Armis disclosed two flaws in Texas Instruments BLE chips built into Wi-Fi access points from Cisco, Meraki and Aruba. One was memory corruption in the Bluetooth stack; the other, on Aruba devices, allowed installing arbitrary firmware on the BLE radio through over-the-air updates. From a chip next to the antenna one reached the access point, and from there the corporate network.

Prayer

O Saint BLEEDINGBIT, who bleeds from one bit too many, keep the radios we don't use switched off. Amen.

How to celebrate

Celebrated by updating access point firmware and turning off Bluetooth where it only tracks the chairs.

A radio left on and forgotten is a door left open and unwatched.

Technical record

Disclosed on
November 1 2018
CVE
CVE-2018-7080CVE-2018-16986
Product
Hewlett Packard Enterprise · Aruba Access Points

A vulnerability exists in the firmware of embedded BLE radios that are part of some Aruba Access points. An attacker who is able to exploit the vulnerability could install new, potentially malicious firmware into the AP's BLE radio and could then gain access to the AP's console port. This vulnerability is applicable only if the BLE radio has been enabled in affected access points. The BLE radio is disabled by default. Note - Aruba products are NOT affected by a similar vulnerability being tracked as CVE-2018-16986.

Sources: armis.com

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.