Integer overflow

Integer overflow in the dhcpv6getoption function in gdhcp/client.c in ConnMan before 0.85 allows remote attackers to cause a denial of service infinite loop and crash via an invalid length value in a DHCP packet...

UBUNTU-CVE-2012-2320

ConnMan before 0.85 does not ensure that netlink messages originate from the kernel, which allows remote attackers to bypass intended access restrictions and cause a denial of service via a crafted netlink message...

UBUNTU-CVE-2012-2321

The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 host name or 2 domain name in a DHCP reply...

UBUNTU-CVE-2012-2322

Integer overflow in the dhcpv6getoption function in gdhcp/client.c in ConnMan before 0.85 allows remote attackers to cause a denial of service infinite loop and crash via an invalid length value in a DHCP packet...

CVE-2012-2322

ConnMan contains an integer overflow in the DHCPv6 handling path (dhcpv6_get_option in gdhcp/client.c) that affects versions before 0.85. An invalid length in a DHCP packet can trigger an infinite loop and crash, enabling a remote DoS. Affected: ConnMan’s DHCPv6 option parsing. Mitigation: upgrad...

CVE-2012-2320

CVE-2012-2320 concerns ConnMan, where the component does not verify that netlink messages originate from the kernel, allowing remote attackers to bypass access restrictions and cause a denial of service via a crafted netlink message. The vulnerability affects ConnMan up to version prior to 0.85. ...

CVE-2012-2322

Integer overflow in the dhcpv6getoption function in gdhcp/client.c in ConnMan before 0.85 allows remote attackers to cause a denial of service infinite loop and crash via an invalid length value in a DHCP packet...

CVE-2012-2321

The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 host name or 2 domain name in a DHCP reply...

CVE-2012-2321

ConnMan CVE-2012-2321 affects the loopback plug-in; versions before 0.85 are vulnerable to remote code execution via shell metacharacters in the DHCP reply host or domain name. The issue enables an attacker to run arbitrary commands with the process’s privileges when processing DHCP responses. Ex...

CVE-2012-2320

ConnMan before 0.85 does not ensure that netlink messages originate from the kernel, which allows remote attackers to bypass intended access restrictions and cause a denial of service via a crafted netlink message...

CVE-2012-2320

ConnMan before 0.85 does not ensure that netlink messages originate from the kernel, which allows remote attackers to bypass intended access restrictions and cause a denial of service via a crafted netlink message...

CVE-2012-2321

The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 host name or 2 domain name in a DHCP reply...

CVE-2012-2322

Integer overflow in the dhcpv6getoption function in gdhcp/client.c in ConnMan before 0.85 allows remote attackers to cause a denial of service infinite loop and crash via an invalid length value in a DHCP packet...

ConnMan: Multiple vulnerabilities

Background ConnMan provides a daemon for managing Internet connections. Description Multiple vulnerabilities have been found in ConnMan: Errors in inet.c and rtnl.c prevent ConnMan from checking the origin of netlink messages CVE-2012-2320. ConnMan does not properly check for shell escapes when...