Blame
| 5202bd | Samuli Seppänen | 2025-02-27 09:59:41 | 1 | # CVE-2017-12166: out of bounds write in key-method 1 |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 2 | |
| 5202bd | Samuli Seppänen | 2025-02-27 09:59:41 | 3 | OpenVPN 2.4.4 and 2.3.18 resolve an out-of-bounds write vulnerability, that was discovered by Guide Vranken. |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 4 | |
| 5202bd | Samuli Seppänen | 2025-02-27 09:59:41 | 5 | This vulnerability is only exposed when explicitly selecting `key-method 1` in the config (or on the command line). This option is only available for backward compatibility with OpenVPN 1.x, and has no longer been the default since the release of OpenVPN 2.0 in 2005. It will be removed all together in OpenVPN 2.5. |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 6 | |
| 5202bd | Samuli Seppänen | 2025-02-27 09:59:41 | 7 | Commit message: |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 8 | |
| 9 | ``` |
|||
| 10 | Fix bounds check in read_key() |
|||
| 11 | ||||
| 5202bd | Samuli Seppänen | 2025-02-27 09:59:41 | 12 | The bounds check in read_key() was performed after using the value, instead |
| 13 | of before. If 'key-method 1' is used, this allowed an attacker to send a |
|||
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 14 | malformed packet to trigger a stack buffer overflow. |
| 15 | ||||
| 16 | Fix this by moving the input validation to before the writes. |
|||
| 17 | ||||
| 18 | Note that 'key-method 1' has been replaced by 'key method 2' as the default |
|||
| 19 | in OpenVPN 2.0 (released on 2005-04-17), and explicitly deprecated in 2.4 |
|||
| 20 | and marked for removal in 2.5. This should limit the amount of users |
|||
| 21 | impacted by this issue. |
|||
| 22 | ||||
| 23 | CVE: 2017-12166 |
|||
| 24 | Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> |
|||
| 25 | Acked-by: Gert Doering <gert@greenie.muc.de> |
|||
| 26 | Acked-by: David Sommerseth <davids@openvpn.net> |
|||
| 27 | Message-Id: <80690690-67ac-3320-1891-9fecedc6a1fa@fox-it.com> |
|||
| 28 | URL: https://www.mail-archive.com/search?l=mid&q=80690690-67ac-3320-1891-9fecedc6a1fa@fox-it.com |
|||
| 29 | Signed-off-by: David Sommerseth <davids@openvpn.net> |
|||
| 30 | ``` |
|||
| 31 | ||||
| 5202bd | Samuli Seppänen | 2025-02-27 09:59:41 | 32 | [Mail thread reporting the vulnerability](https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg15492.html) |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 33 | |
| 5202bd | Samuli Seppänen | 2025-02-27 09:59:41 | 34 | Fixes in tree: |
| c4f02d | Samuli Seppänen | 2025-01-29 08:37:37 | 35 | |
| 5202bd | Samuli Seppänen | 2025-02-27 09:59:41 | 36 | * commit 3b1a61e9fb27213c46f76312f4065816bee8ed01 (master) |
| 37 | * commit c7e259160b28e94e4ea7f0ef767f8134283af255 (release/2.4) |
|||
| 38 | * commit fce34375295151f548a26c2d0eb30141e427c81a (release/2.3) |
|||
| 39 | * commit a9f5c744d6b09f2495ca48d2c926efd3a4b981e6 (release/2.2) |
|||
| 40 | * commit c560f95e7038daa3a1b5a08b69b85fb68d4eeef3 (release/2.1) |