VulnerabilityModified

CVE-2017-12865

Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the "name" variable.

CRITICAL 9.8EPSS 5.52%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 5.52% probability · 92th percentile
CISA KEV: Not listed
Weakness: CWE-119
Affected: intel/connman · debian/debian linux
Source: cve@mitre.org

References

http://www.debian.org/security/2017/dsa-3956Third Party Advisory
http://www.securityfocus.com/bid/100498Third Party Advisory, VDB Entry
https://01.org/security/intel-oss-10001/intel-oss-10001Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1483720Issue Tracking, Patch, Third Party Advisory
https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=5c281d182ecdd0a424b64f7698f32467f8f67b71Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201812-02Third Party Advisory
https://www.nri-secure.com/blog/new-iot-vulnerability-connmandoThird Party Advisory
http://www.debian.org/security/2017/dsa-3956Third Party Advisory
http://www.securityfocus.com/bid/100498Third Party Advisory, VDB Entry
https://01.org/security/intel-oss-10001/intel-oss-10001Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1483720Issue Tracking, Patch, Third Party Advisory
https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=5c281d182ecdd0a424b64f7698f32467f8f67b71Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201812-02Third Party Advisory
https://www.nri-secure.com/blog/new-iot-vulnerability-connmandoThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.