CVE-2010-3903: Medium severity openconnect vulnerability
Published Oct 12, 2010
·Updated
Unspecified vulnerability in OpenConnect before 2.23 allows remote AnyConnect SSL VPN servers to cause a denial of service (application crash) via a 404 HTTP status code.
Affected Software
13 affected components
Infradead Openconnect=1.40
Infradead Openconnect=1.00
Infradead Openconnect=1.30
Infradead Openconnect=2.00
Infradead Openconnect=2.21
Infradead Openconnect<=2.22
Infradead Openconnect=2.11
Infradead Openconnect=1.10
Infradead Openconnect=2.10
Infradead Openconnect=2.01
Infradead Openconnect=2.12
Infradead Openconnect=2.20
Infradead Openconnect=1.20
Event History
Oct 12, 2010
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2010-3903?
CVE-2010-3903 has a severity rating that can lead to denial of service due to application crashes.
2
How do I fix CVE-2010-3903?
To fix CVE-2010-3903, upgrade to a version of OpenConnect beyond 2.22.
3
What versions of OpenConnect are affected by CVE-2010-3903?
CVE-2010-3903 affects OpenConnect versions 1.00, 1.10, 1.20, 1.30, 1.40, 2.00, 2.10, 2.11, 2.12, 2.20, 2.21, and all versions up to 2.22.
4
Can CVE-2010-3903 be exploited remotely?
Yes, CVE-2010-3903 can be exploited remotely by sending a specific 404 HTTP status code from an AnyConnect SSL VPN server.
5
What impact does CVE-2010-3903 have on OpenConnect users?
CVE-2010-3903 can cause OpenConnect applications to crash, leading to a denial of service for users.