forked from pool/openvpn
48eb5a9bd5
- Do bound check in read_key before using values(CVE-2017-12166 bsc#1060877). [+ 0002-Fix-bounds-check-in-read_key.patch] OBS-URL: https://build.opensuse.org/request/show/533031 OBS-URL: https://build.opensuse.org/package/show/network:vpn/openvpn?expand=0&rev=127
59 lines
1.9 KiB
Diff
59 lines
1.9 KiB
Diff
From 3b1a61e9fb27213c46f76312f4065816bee8ed01 Mon Sep 17 00:00:00 2001
|
|
From: Steffan Karger <steffan.karger@fox-it.com>
|
|
Date: Tue, 15 Aug 2017 10:04:33 +0200
|
|
Subject: [PATCH] Fix bounds check in read_key()
|
|
|
|
The bounds check in read_key() was performed after using the value, instead
|
|
of before. If 'key-method 1' is used, this allowed an attacker to send a
|
|
malformed packet to trigger a stack buffer overflow.
|
|
|
|
Fix this by moving the input validation to before the writes.
|
|
|
|
Note that 'key-method 1' has been replaced by 'key method 2' as the default
|
|
in OpenVPN 2.0 (released on 2005-04-17), and explicitly deprecated in 2.4
|
|
and marked for removal in 2.5. This should limit the amount of users
|
|
impacted by this issue.
|
|
|
|
CVE: 2017-12166
|
|
Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
|
|
Acked-by: Gert Doering <gert@greenie.muc.de>
|
|
Acked-by: David Sommerseth <davids@openvpn.net>
|
|
Message-Id: <80690690-67ac-3320-1891-9fecedc6a1fa@fox-it.com>
|
|
URL: https://www.mail-archive.com/search?l=mid&q=80690690-67ac-3320-1891-9fecedc6a1fa@fox-it.com
|
|
Signed-off-by: David Sommerseth <davids@openvpn.net>
|
|
---
|
|
src/openvpn/crypto.c | 10 +++++-----
|
|
1 file changed, 5 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
|
|
index 131257e5..3f3caa1c 100644
|
|
--- a/src/openvpn/crypto.c
|
|
+++ b/src/openvpn/crypto.c
|
|
@@ -1666,6 +1666,11 @@ read_key(struct key *key, const struct key_type *kt, struct buffer *buf)
|
|
goto read_err;
|
|
}
|
|
|
|
+ if (cipher_length != kt->cipher_length || hmac_length != kt->hmac_length)
|
|
+ {
|
|
+ goto key_len_err;
|
|
+ }
|
|
+
|
|
if (!buf_read(buf, key->cipher, cipher_length))
|
|
{
|
|
goto read_err;
|
|
@@ -1675,11 +1680,6 @@ read_key(struct key *key, const struct key_type *kt, struct buffer *buf)
|
|
goto read_err;
|
|
}
|
|
|
|
- if (cipher_length != kt->cipher_length || hmac_length != kt->hmac_length)
|
|
- {
|
|
- goto key_len_err;
|
|
- }
|
|
-
|
|
return 1;
|
|
|
|
read_err:
|
|
--
|
|
2.13.6
|
|
|