PT-2025-15990 · Connman+1 · Connman+1

Published 2025-04-10 · Updated 2025-04-11 · CVE-2025-32743

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ConnMan versions 1.44 and earlier

Description: The issue in ConnMan allows attackers to cause a denial of service or possibly execute arbitrary code by manipulating DNS responses. This occurs when the lookup string in ns resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a DNS response, leading to incorrect length calculations and incorrect memcpy operations.

Recommendations: For ConnMan versions 1.44 and earlier, as a temporary workaround, consider restricting the handling of DNS responses with the TC bit set to prevent potential exploitation. However, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-392

Related Identifiers

BDU:2025-04690

CVE-2025-32743

Affected Products

Connman

Debian

References · 19

• https://security-tracker.debian.org/tracker/CVE-2025-32743 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-32743 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-32743 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-32743 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04690 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-32743 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32743 · Security Note
• https://twitter.com/CveFindCom/status/1910332224106299475 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1910368490864758998 · Twitter Post
• https://cve.omp.ru/bb30515 · Note
• https://t.me/cvedetector/22657 · Telegram Post
• https://web.git.kernel.org/pub/scm/network/connman/connman.git/tree/src/dnsproxy.c?h=1.44#n1688 · Note
• https://t.me/tmfeed/241474 · Telegram Post
• https://lapis-sawfish-be3.notion.site/0-click-Vulnerability-in-Comman-1-43_v3-1cadc00d01d080b0b3b9c46a6da584cc · Note