CVE-2017-12865

CRITICAL

Intel Connman < 1.34 - Memory Corruption

Title source: rule

Description

Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the "name" variable.

Exploits (1)

nomisec WORKING POC

by ManaswiJaiswal · poc

https://github.com/ManaswiJaiswal/Reproducing-ConnMan-1.34

View Code ZIP pw:eip

References (7)

[Third Party Advisory] http://www.debian.org/security/2017/dsa-3956

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/100498

[Vendor Advisory] https://01.org/security/intel-oss-10001/intel-oss-10001

[Issue Tracking, Patch, Third Party Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=1483720

[Issue Tracking, Patch, Third Party Advisory] https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=5c281d182ecdd0a424b64f7698f32467f8f67b71

[Third Party Advisory] https://security.gentoo.org/glsa/201812-02

[Third Party Advisory] https://www.nri-secure.com/blog/new-iot-vulnerability-connmando

Scores

CVSS v3 9.8

EPSS 0.0376

EPSS Percentile 88.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (2)

debian/debian_linux 8.0

intel/connman < 1.34

Published Aug 29, 2017

Tracked Since Feb 18, 2026