PT-2013-1236 · Openconnect+1 · Openconnect+1

Kevin Cernekee · Published 2013-02-24 · Updated 2024-06-15 · CVE-2012-6128

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenConnect versions prior to 4.08

Description The issue is related to multiple stack-based buffer overflows in the http.c file of OpenConnect. These overflows can be triggered by remote VPN gateways sending responses with long hostnames, paths, or cookie lists, leading to a denial of service in the form of an application crash. The vulnerability can be exploited remotely and may result in the disruption of protected information availability.

Recommendations For OpenConnect versions prior to 4.08, update to version 4.08 or later to resolve the issue. As a temporary workaround, consider restricting the length of hostnames, paths, and cookie lists in responses from remote VPN gateways to prevent the buffer overflows.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2014-1311

BDU:2015-09725

CVE-2012-6128

DSA-2623-1

OPENSUSE-SU-2024:10553-1

Affected Products

Alt Linux

Openconnect

References · 26

• https://osv.dev/vulnerability/DEBIAN-CVE-2012-6128 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7098 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6128 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-6128 · Vendor Advisory
• http://git.infradead.org/users/dwmw2/openconnect.git/commitdiff/26f752c3dbf69227679fc6bebb4ae071aecec491 · Vendor Advisory
• http://securityfocus.com/bid/57884 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-6128 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-6128 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10553-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:108 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-06/msg00115.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-6128 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-1311 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-6128 · Security Note
• https://ubuntu.com/security/CVE-2012-6128 · Vendor Advisory