CVE-2012-6128: stack-based buffer overflow in OpenConnect

Debian Bug report logs - #700794
CVE-2012-6128: stack-based buffer overflow in OpenConnect

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Mike Miller <mtmiller@ieee.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2012-6128: stack-based buffer overflow in OpenConnect

Date: Sun, 17 Feb 2013 10:49:42 -0500

Package: openconnect
Version: 3.20-2
Severity: critical

CVE-2012-6128 concerns a stack-based buffer overflow that can be
triggered by data read from a remote host, either a man-in-the-middle
or a malicious VPN.

The issue has been fixed in squeeze with 2.25-0.1+squeeze2. It should
be easy to apply the same patch to 3.20 to fix this in wheezy and sid.

I have recently uploaded 4.99-1 to experimental which already contains
the fix upstream.

-- 
mike

Message #18 received at 700794-close@bugs.debian.org (full text, mbox, reply):

From: Mike Miller <mtmiller@ieee.org>

To: 700794-close@bugs.debian.org

Subject: Bug#700794: fixed in openconnect 3.20-3

Date: Sun, 17 Feb 2013 17:47:53 +0000

Source: openconnect
Source-Version: 3.20-3

We believe that the bug you reported is fixed in the latest version of
openconnect, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 700794@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mike Miller <mtmiller@ieee.org> (supplier of updated openconnect package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sun, 17 Feb 2013 11:56:35 -0500
Source: openconnect
Binary: openconnect libopenconnect1 libopenconnect-dev
Architecture: source amd64
Version: 3.20-3
Distribution: unstable
Urgency: low
Maintainer: Mike Miller <mtmiller@ieee.org>
Changed-By: Mike Miller <mtmiller@ieee.org>
Description: 
 libopenconnect-dev - Open client for Cisco AnyConnect VPN - development files
 libopenconnect1 - Open client for Cisco AnyConnect VPN - shared library
 openconnect - Open client for Cisco AnyConnect VPN
Closes: 700794
Changes: 
 openconnect (3.20-3) unstable; urgency=low
 .
   * debian/patches/02_CVE-2012-6128.patch: Backport patch from upstream to fix
     buffer overflow (CVE-2012-6128). (Closes: #700794)
Checksums-Sha1: 
 f89da349d905f77b2eb7c15061fefd0ade75bd7d 2070 openconnect_3.20-3.dsc
 81fc2cda7dd209ceec34d7488f56067062199187 7640 openconnect_3.20-3.debian.tar.gz
 c44344fc8aee41b4f88dbd1e93cdd0081ae4cd3c 197588 openconnect_3.20-3_amd64.deb
 baa50c5b2a11ad1d01677a96970cd0cee2acfe5e 43398 libopenconnect1_3.20-3_amd64.deb
 bbacd54eb2c1845358bbb52e9f78ed14f47e6133 17872 libopenconnect-dev_3.20-3_amd64.deb
Checksums-Sha256: 
 f5ffb4cca8f0362f04467d85cff88651e473fe568b2744d5cb31f80f8d70f4bd 2070 openconnect_3.20-3.dsc
 2b511f9590db592035e3f4606cd706b8ea245785567a86fa1b4ccb136ab0533e 7640 openconnect_3.20-3.debian.tar.gz
 5d3edafa9f459fd49e63968f7e6c1afe0cbc6e83b22d4a8bca73c4cb1fe95c29 197588 openconnect_3.20-3_amd64.deb
 f7be0b4cf9a2a7903b95da733631e742f01e548b65fb8c87e13ec2ba35690120 43398 libopenconnect1_3.20-3_amd64.deb
 87cd81514dba2047edffdf87d139a566c9300bbc80dc69c6743876842e47ef4c 17872 libopenconnect-dev_3.20-3_amd64.deb
Files: 
 459c4765e9df2f9152e71894076c9855 2070 net optional openconnect_3.20-3.dsc
 3a681761f33e9d363b68d81bd80c262c 7640 net optional openconnect_3.20-3.debian.tar.gz
 0011cce1f32277fcaad9fde3cb27c0c4 197588 net optional openconnect_3.20-3_amd64.deb
 596b63d83559fda6d25faa0ae8aa7942 43398 libs optional libopenconnect1_3.20-3_amd64.deb
 3dff04a164bee92f2f67be3c6b812d6c 17872 libdevel optional libopenconnect-dev_3.20-3_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCAAGBQJRIRO9AAoJECj6gBpDvdY3zfUP/iJvhsiuIUm1mzZbQgUW/hw7
C0UfkqVCqWZtGcB/I6fi1O7e/DgSqWYZAiseeiUE90Fqqs4T/rGWLlaLdGlWUETv
a+SIdou8LZIthGxq2Sg5u/AY8x3baDNhNdqAZwhKO+5UDsPiq3fvNsVE29tw6den
ccEmbSnEigRYA5OGjfZmFO0MkyoNF78Iyp+yIRTckyg3D3SO1HnzisgQC3P9DgLi
h0CJupPn13r+K3YQsGm58lDQ/Kld1R9dKiu6rm5jh9I+V/1mQvDafb3+ZdbJGV6y
E9KK0VfDZkSUb9XXlS6jHVgQljcxFSmI580KgR0yowerRRnPzFo32mBEwfscLBmT
WB8LslS72Q9jbVjguBfByF4YAT7wyL3sghC0UO1D5M7EBO8+dhcx+NJZH0nMBKd2
oMl9MgizM3EQuMX1Zmk2L/057BJd3406IzC2pArBoaLzY1wDtKElbpRqTZ3YJrdw
vfeWbVtf4joyg7Q19PouwP/yfQsl9MiVuPhuZpyU4iwGnvFiGosPztQKy99Iv10x
4jTywO2bVcqq3BJ/BPxie2nYOncYi8bCf+iPDWUTG8XH5Q4jmTjyEXQ/yO7PE92G
vImXNj28EMYzthywUopTpH4AsbuHSleM0seRBrG/GwS1EiD9FPktHtH4wla2wKMf
FFc+jVf1b7+h0TfZj2zq
=+5CQ
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.