Vulnerability Description
Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the "name" variable.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Intel | Connman | <= 1.34 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://www.debian.org/security/2017/dsa-3956Third Party Advisory
- http://www.securityfocus.com/bid/100498Third Party AdvisoryVDB Entry
- https://01.org/security/intel-oss-10001/intel-oss-10001Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1483720Issue TrackingPatchThird Party Advisory
- https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=5c281d182eIssue TrackingPatchThird Party Advisory
- https://security.gentoo.org/glsa/201812-02Third Party Advisory
- https://www.nri-secure.com/blog/new-iot-vulnerability-connmandoThird Party Advisory
- http://www.debian.org/security/2017/dsa-3956Third Party Advisory
- http://www.securityfocus.com/bid/100498Third Party AdvisoryVDB Entry
- https://01.org/security/intel-oss-10001/intel-oss-10001Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1483720Issue TrackingPatchThird Party Advisory
- https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=5c281d182eIssue TrackingPatchThird Party Advisory
- https://security.gentoo.org/glsa/201812-02Third Party Advisory
- https://www.nri-secure.com/blog/new-iot-vulnerability-connmandoThird Party Advisory
FAQ
What is CVE-2017-12865?
CVE-2017-12865 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passe...
How severe is CVE-2017-12865?
CVE-2017-12865 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-12865?
Check the references section above for vendor advisories and patch information. Affected products include: Intel Connman, Debian Debian Linux.