An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation lacks a check for the presence of sufficient Header Data, leading to an out-of-bounds read.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation
    lacks a check for the presence of sufficient Header Data, leading to an out-of-bounds read.
    (CVE-2022-23096)

  - An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen
    call, leading to an out-of-bounds read. (CVE-2022-23097)

  - An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has
    an infinite loop if no data is received. (CVE-2022-23098)

The remote host is affected by the vulnerability described in GLSA-202310-21 (ConnMan: Multiple Vulnerabilities)

  - An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation     lacks a check for the presence of sufficient Header Data, leading to an out-of-bounds read.
    (CVE-2022-23096)

  - An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen     call, leading to an out-of-bounds read. (CVE-2022-23097)

  - An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has     an infinite loop if no data is received. (CVE-2022-23098)

  - In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to     exploit a heap-based buffer overflow in received_data to execute code. (CVE-2022-32292)

  - In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a     use-after-free in WISPR handling, leading to crashes or code execution. (CVE-2022-32293)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6236-1 advisory.

    It was discovered that ConnMan could be made to write out of bounds. A remote attacker could possibly use     this issue to cause ConnMan to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-26675, CVE-2021-33833)

    It was discovered that ConnMan could be made to leak sensitive information via the gdhcp component. A     remote attacker could possibly use this issue to obtain information for further exploitation. This issue     only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-26676)

    It was discovered that ConnMan could be made to read out of bounds. A remote attacker could possibly use     this issue to case ConnMan to crash, resulting in a denial of service. This issue only affected Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-23096, CVE-2022-23097)

    It was discovered that ConnMan could be made to run into an infinite loop. A remote attacker could     possibly use this issue to cause ConnMan to consume resources and to stop operating, resulting in a denial     of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu     22.04 LTS. (CVE-2022-23098)

    It was discovered that ConnMan could be made to write out of bounds via the gweb component. A remote     attacker could possibly use this issue to cause ConnMan to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04     LTS, and Ubuntu 22.04 LTS. (CVE-2022-32292)

    It was discovered that ConnMan did not properly manage memory under certain circumstances. A remote     attacker could possibly use this issue to cause ConnMan to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04     LTS, and Ubuntu 22.04 LTS. (CVE-2022-32293)

    It was discovered that ConnMan could be made to write out of bounds via the gdhcp component. A remote     attacker could possibly use this issue to cause ConnMan to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2023-28488)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3144 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3144-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     October 10, 2022                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : connman     Version        : 1.36-2.1~deb10u4     CVE ID         : CVE-2022-23096 CVE-2022-23097 CVE-2022-23098 CVE-2022-32293     Debian Bug     : 1004935 1016976

    Several vulnerabilities were discovered in ConnMan, a network manager     for embedded devices, which could result in denial of service or the     execution of arbitrary code.

    This update also fixes an issue with reference counting in the     CVE-2022-32293 fix introduced in DLA-3105-1.

    For Debian 10 buster, these problems have been fixed in version     1.36-2.1~deb10u4.

    We recommend that you upgrade your connman packages.

    For the detailed security status of connman please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/connman

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5231 advisory.

    Several vulnerabilities were discovered in ConnMan, a network manager for embedded devices, which could     result in denial of service or the execution of arbitrary code. For the stable distribution (bullseye),     these problems have been fixed in version 1.36-2.2+deb11u1. We recommend that you upgrade your connman     packages. For the detailed security status of connman please refer to its security tracker page at:
    https://security-tracker.debian.org/tracker/connman

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2915 advisory.

    Several issues were found in ConnMan, a connection manager for embedded devices, that could cause denial     of service via service crash or excessive CPU usage. For Debian 9 stretch, these problems have been fixed     in version 1.33-3+deb9u3. We recommend that you upgrade your connman packages. For the detailed security     status of connman please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/connman Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
403873	Alpine: multiple connman packages: security update to 1.41-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
403873	Alpine: multiple connman packages: security update to 1.41-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
184065	GLSA-202310-21 : ConnMan: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
178482	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : ConnMan vulnerabilities (USN-6236-1)	Nessus	Ubuntu Local Security Checks	critical
166020	Debian dla-3144 : connman - security update	Nessus	Debian Local Security Checks	critical
165255	Debian DSA-5231-1 : connman - security update	Nessus	Debian Local Security Checks	critical
157846	Debian DLA-2915-1 : connman - LTS security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2022-23096

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical