Vulnerability in bundled LZO compression code

[hanno]

It has been reported that the compression code for the LZO algorithm has an integer overflow:
​http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html
Amongst many other software projects OpenVPN bundles the LZO code, so it is probably affected.

[hanno]

CVE for the original LZO code is CVE-2014-4607.

[Gert Döring]

We do not bundle LZO but use what the operating system / package management provides (except for Windows, where we indeed provide binaries with compiled in LZO).

We have discussed this vulnerability and came to the conclusion that OpenVPN is not affected, as exploitation requires decompression of 16 mbyte of zero data. OpenVPN decompresses each packet individually, not carrying over state to the next packet, so this is just plain impossible to achieve for UDP (max 64 kbyte including fragmentation), and for TCP, OpenVPN enforces a maximum "openvpn packet lenght" depending on MTU etc., so also well below 16mb.

... it might still be reasonable to re-spin the windows packages with lzo 2.07 to avoid repetitions of this question :-)

[Samuli Seppänen]

The later LZO version require some patches to compile using openvpn-build. Afaik pekster has those patches, so I definitely need to bite the bullet at some point and respin the installers.

[Samuli Seppänen]

lzo-2.0.8 actually builds using openvpn-build, so it lzo will get updated in next Windows installer release.

[Gert Döring]

Tried the 2.3.6-I001-x86_64 installer, and "openvpn --version" says "LZO 2.08".

Same thing for the 2.3.6-I601-i686 installer.

So I think we can close this ticket for good \o/