PT-2013-1236 · Openconnect+1 · Openconnect+1

Kevin Cernekee · Publicado 2013-02-24 · Atualizado 2024-06-15 · CVE-2012-6128

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenConnect versions prior to 4.08

Description The issue is related to multiple stack-based buffer overflows in the http.c file of OpenConnect. These overflows can be triggered by remote VPN gateways sending responses with long hostnames, paths, or cookie lists, leading to a denial of service in the form of an application crash. The vulnerability can be exploited remotely and may result in the disruption of protected information availability.

Recommendations For OpenConnect versions prior to 4.08, update to version 4.08 or later to resolve the issue. As a temporary workaround, consider restricting the length of hostnames, paths, and cookie lists in responses from remote VPN gateways to prevent the buffer overflows.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2014-1311

BDU:2015-09725

CVE-2012-6128

DSA-2623-1

OPENSUSE-SU-2024:10553-1

Produtos afetados

Alt Linux

Openconnect

Referências · 26

• https://osv.dev/vulnerability/DEBIAN-CVE-2012-6128 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7098 · Nota de Segurança
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0060 · Nota
• http://infradead.org/openconnect/changelog.html · Nota
• http://security.gentoo.org/glsa/glsa-201405-18.xml · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6128 · Nota de Segurança
• https://suse.com/security/cve/CVE-2012-6128 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-6128 · Aviso do Fabricante
• http://git.infradead.org/users/dwmw2/openconnect.git/commitdiff/26f752c3dbf69227679fc6bebb4ae071aecec491 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82058 · Nota
• http://securityfocus.com/bid/57884 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-6128 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-6128 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10553-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-7098 · Nota