CVE-2012-6128: Buffer Overflow
Published Feb 24, 2013
·Updated
Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (application crash) via a long (1) hostname, (2) path, or (3) cookie list in a response.
Affected Software
39 affected components
Infradead Openconnect<=4.07
Infradead Openconnect=1.00
Infradead Openconnect=1.10
Infradead Openconnect=1.20
Infradead Openconnect=1.30
Infradead Openconnect=1.40
Infradead Openconnect=2.00
Infradead Openconnect=2.01
Infradead Openconnect=2.10
Infradead Openconnect=2.11
Infradead Openconnect=2.12
Infradead Openconnect=2.20
Infradead Openconnect=2.21
Infradead Openconnect=2.22
Infradead Openconnect=2.23
Infradead Openconnect=2.24
Infradead Openconnect=2.25
Infradead Openconnect=2.26
Infradead Openconnect=3.00
Infradead Openconnect=3.01
Infradead Openconnect=3.02
Infradead Openconnect=3.11
Infradead Openconnect=3.12
Infradead Openconnect=3.13
Infradead Openconnect=3.14
Infradead Openconnect=3.15
Infradead Openconnect=3.16
Infradead Openconnect=3.17
Infradead Openconnect=3.18
Infradead Openconnect=3.19
Infradead Openconnect=3.20
Infradead Openconnect=3.99
Infradead Openconnect=4.00
Infradead Openconnect=4.01
Infradead Openconnect=4.02
Infradead Openconnect=4.03
Infradead Openconnect=4.04
Infradead Openconnect=4.05
Infradead Openconnect=4.06
Event History
Feb 24, 2013
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-6128?
CVE-2012-6128 is classified as having a high severity due to the potential for denial of service and application crashes.
2
How do I fix CVE-2012-6128?
To fix CVE-2012-6128, you should update OpenConnect to version 4.08 or later.
3
What software is affected by CVE-2012-6128?
CVE-2012-6128 affects multiple versions of OpenConnect prior to version 4.08.
4
What type of vulnerability is CVE-2012-6128?
CVE-2012-6128 is a stack-based buffer overflow vulnerability.
5
Can CVE-2012-6128 be exploited remotely?
Yes, CVE-2012-6128 can be exploited remotely by sending specifically crafted long hostnames, paths, or cookie lists.