OpenConnect is prone to an overflow condition. The program fails to properly sanitize user-supplied input resulting in a buffer overflow. When generating a user-agent string, an attacker may be able to execute arbitrary code or potentially cause a denial of service.
Classification
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Unknown
Disclosure:
Vendor Verified
Solution
Upgrade to version 2.12 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
