Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.2141
connman security update
28 August 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: connman
Publisher: Debian
Operating System: Debian GNU/Linux 8
Debian GNU/Linux 9
Linux variants
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2017-12865
Original Bulletin:
http://www.debian.org/security/2017/dsa-3956
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running connman check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3956-1 security@debian.org
https://www.debian.org/security/ Luciano Bello
August 27, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : connman
CVE ID : CVE-2017-12865
Debian Bug : 872844
Security consultants in NRI Secure Technologies discovered a stack
overflow vulnerability in ConnMan, a network manager for embedded
devices. An attacker with control of the DNS responses to the DNS proxy
in ConnMan might crash the service and, in same cases, remotely execute
arbitrary commands in the host running the service.
For the oldstable distribution (jessie), this problem has been fixed
in version 1.21-1.2+deb8u1.
For the stable distribution (stretch), this problem has been fixed in
version 1.33-3+deb9u1.
For the testing distribution (buster), this problem has been fixed
in version 1.33-3+deb9u1.
For the unstable distribution (sid), this problem has been fixed in
version 1.35-1.
We recommend that you upgrade your connman packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEayzFlnvRveqeWJspbsLe9o/+N3QFAlmjRVgACgkQbsLe9o/+
N3T3/Q//VQRbz2KIvb/nJA79D9HsmJiV5MCs8odlsPfV+796eENsgepO3elsdm75
vo5FHTORoN+tc2cw9zOkpgR/tTNYVFq/adcchecjW6E8Ruh57AwT1PaDDStaTger
ra9tk3QBVOWBkhdZmag8RxNt99EK9o1pVn0zu2cdNWwWR+0DJFLOTn+icvaX9a00
E53GXX/CCMEYw0Smo3t3D0HuR6NLLDFbyV1Cf/fte29Hdt7Ni0aXUZsjyqlND7LI
mF1m4OcouoGhS/QFBEkIsduMs07Merc7ZHQ93z/RMtqQzo9Ev/7qBsgGG7TokTif
m+HmH6x6OJ+QIVca2VK7i3pKmWu+zLtF5zixG/U0ED5nVoeDE1vnHmLlQilHOzi/
Dxmb6gPNQvbLYE3Hr2ytgL4ICmADVeUlpVfEc4km17G8fiTCaCY5vAlKRUy209bE
d9izLn1u3J2i1gb3IsJ1qxfIG3kxy6xnXXED0sGZXCp61HU2SaXTiK76B5MLiBHP
wQN335oSsRIbORSsCvfcqVUAtLs9BLqV3fQ57wb7nM5qH7vfHndcGXc/lVNb6eJe
3PjOIyDUU58K987FnvbN+FSWGuv5cfbsQLZwfICU5s95r2EAoS06tk2/iGU76Wwy
zjmu3on4C2men6TxIaWCOamkBR+igB9MvRIRD2wRIUkg5mudmf8=
=p3fr
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWaN77Yx+lLeg9Ub1AQhwQRAAiVNUD7VoO0MLAHxVqx2SlisJPlD+ZCJ+
nNg20FR+mWqu9ebNbmqwHPTZ/xrLhVLmj3xggvVVklemL+VHzyRFMDTFCX43P/nF
Wb8tx+DeCJFDeE+4WYpGJtSybnBFwWmtAehIIJetOq4jRkGfXof0+JT9QmbXc9ki
uN9zAG6kbaR42nGSJxL4YNvmlyTSOs1R23O25bI6lzTRjOdzMZx2/FGH5tAvvW7v
3OMzofCX7JqoRBLtgtt9r80UM/w9iImb9Jc/fuuZWkxkyoXiffhbO8QVGOh4bV7G
AumIdxPKEwWijbKqn/a/uUBBX2GObR3RyRU81uZ8fqPN0RON7EvWgxgtPKVeLwHO
cJIZ/X8/nyaZ+pHxqhuoJv3iWSHdqbvaogVKHtQTWpPl0NXSBBE6YVRgzaIe5Elm
vFNMhkVM0WTdI/YqNG4+hFEN7MZT8qC447Eefb5cN7faJyM+b2/ZMMHuScwmQ2fu
KlaVgZoAeUvPLer6HOfSPREh2bggyIWooBrrce1596q6LtAmz2HLZYLztQQDpy0N
TjiJJqvLVUim4R2fR1T0Kwe/rraU7fUr2z2Lgjj9lFI958YzSk5XyfntBI3dKK2m
Y2ZD+8l5pETn5GSzMIAMaNXuxH7cnbE0VNpJAswgzNLAk1T63Ohcc8Zd1EW52T8d
lQQXrpSef6o=
=ocb0
-----END PGP SIGNATURE-----