Import Debian changes 2.3.4-5+deb8u2debian/2.3.4-5+deb8u2

openvpn (2.3.4-5+deb8u2) jessie-security; urgency=high

  * SECURITY UPDATE: authenticated remote DoS vulnerability due to
    packet ID rollover. CVE-2017-7479.
    Kudos to Steve Beattie <sbeattie@ubuntu.com> for doing all the backporting
    work for this patch.
    - debian/patches/CVE-2017-7479-prereq.patch: merge
      packet_id_alloc_outgoing() into packet_id_write()
    - debian/patches/CVE-2017-7479.patch: do not assert when packet ID
      rollover occurs
  * SECURITY UPDATE: (Closes: #865480)
    - CVE-2017-7508.patch. Fix remotely-triggerable ASSERT() on malformed IPv6
      packet.
    - CVE-2017-7520.patch. Prevent two kinds of stack buffer OOB reads and a
      crash for invalid input data.
    - CVE-2017-7521.patch. Fix potential double-free in --x509-alt-username.
    - CVE-2017-7521bis.patch. Fix remote-triggerable memory leaks.

1 files changed, 57 insertions, 0 deletions

diff --git a/debian/patches/CVE-2017-7508.patch b/debian/patches/CVE-2017-7508.patch
new file mode 100644
index 0000000..f096553
--- /dev/null
+++ b/debian/patches/CVE-2017-7508.patch
@@ -0,0 +1,57 @@
+commit fc61d1bda112ffc669dbde961fab19f60b3c7439
+Author: Gert Doering <gert@greenie.muc.de>
+Date:   Tue Jun 13 22:08:32 2017 +0200
+
+    Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
+    
+    Correct sanity checks on IPv6 packet length in mss_fixup_ipv6(),
+    and change the ASSERT() check in mss_fixup_dowork() into a simple
+    "return" (= the TCP header will simply not be inspected further).
+    
+    CVE-2017-7508 has been assigned due to the serious nature of the
+    bug: it can be used to remotely shutdown an openvpn server or
+    client, if IPv6 and --mssfix are enabled and the IPv6 networks used
+    inside the VPN are known.
+    
+    Found by Guido Vranken <guidovranken@gmail.com>.
+    
+    v2: style changes
+    
+    CVE: 2017-7508
+    Signed-off-by: Gert Doering <gert@greenie.muc.de>
+    Acked-by: Steffan Karger <steffan.karger@fox-it.com>
+    Message-Id: <20170613200832.15027-1-gert@greenie.muc.de>
+    URL: https://www.mail-archive.com/search?l=mid&q=20170613200832.15027-1-gert@greenie.muc.de
+    Signed-off-by: Gert Doering <gert@greenie.muc.de>
+    (cherry picked from commit c3f47077a7756de5929094569421a95aa66f2022)
+
+diff --git a/src/openvpn/mss.c b/src/openvpn/mss.c
+index f930942a..c91751d1 100644
+--- a/src/openvpn/mss.c
++++ b/src/openvpn/mss.c
+@@ -110,8 +110,12 @@ mss_fixup_ipv6 (struct buffer *buf, int maxmss)
+   if ( pip6->nexthdr != OPENVPN_IPPROTO_TCP )
+     return;
+ 
++  /* skip IPv6 header (40 bytes),
++   * verify remainder is large enough to contain a full TCP header
++   */
+   newbuf = *buf;
+-  if ( buf_advance( &newbuf, 40 ) )
++  if (buf_advance( &newbuf, 40 )
++      && BLEN(&newbuf) >= (int) sizeof(struct openvpn_tcphdr))
+     {
+       struct openvpn_tcphdr *tc = (struct openvpn_tcphdr *) BPTR (&newbuf);
+       if (tc->flags & OPENVPN_TCPH_SYN_MASK)
+@@ -133,7 +137,10 @@ mss_fixup_dowork (struct buffer *buf, uint16_t maxmss)
+   int accumulate;
+   struct openvpn_tcphdr *tc;
+ 
+-  ASSERT (BLEN (buf) >= (int) sizeof (struct openvpn_tcphdr));
++  if (BLEN(buf) < (int) sizeof(struct openvpn_tcphdr))
++    {
++	return;
++    }
+ 
+   verify_align_4 (buf);
+   tc = (struct openvpn_tcphdr *) BPTR (buf);