diff options
author | Alberto Gonzalez Iniesta <agi@inittab.org> | 2017-06-22 17:25:13 +0200 |
---|---|---|
committer | Bernhard Schmidt <berni@debian.org> | 2017-06-29 22:05:44 +0200 |
commit | 3e3e9b32519a38f9316986b877163d37557b4f70 (patch) | |
tree | 9ee9a4a6f2813fe4ce4623bab80d6a6c30660854 /debian/patches/CVE-2017-7508.patch | |
parent | afc11370be9fd149ab361ca183c9715777b50df0 (diff) |
Import Debian changes 2.3.4-5+deb8u2debian/2.3.4-5+deb8u2
openvpn (2.3.4-5+deb8u2) jessie-security; urgency=high
* SECURITY UPDATE: authenticated remote DoS vulnerability due to
packet ID rollover. CVE-2017-7479.
Kudos to Steve Beattie <sbeattie@ubuntu.com> for doing all the backporting
work for this patch.
- debian/patches/CVE-2017-7479-prereq.patch: merge
packet_id_alloc_outgoing() into packet_id_write()
- debian/patches/CVE-2017-7479.patch: do not assert when packet ID
rollover occurs
* SECURITY UPDATE: (Closes: #865480)
- CVE-2017-7508.patch. Fix remotely-triggerable ASSERT() on malformed IPv6
packet.
- CVE-2017-7520.patch. Prevent two kinds of stack buffer OOB reads and a
crash for invalid input data.
- CVE-2017-7521.patch. Fix potential double-free in --x509-alt-username.
- CVE-2017-7521bis.patch. Fix remote-triggerable memory leaks.
Diffstat (limited to 'debian/patches/CVE-2017-7508.patch')
-rw-r--r-- | debian/patches/CVE-2017-7508.patch | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/debian/patches/CVE-2017-7508.patch b/debian/patches/CVE-2017-7508.patch new file mode 100644 index 0000000..f096553 --- /dev/null +++ b/debian/patches/CVE-2017-7508.patch @@ -0,0 +1,57 @@ +commit fc61d1bda112ffc669dbde961fab19f60b3c7439 +Author: Gert Doering <gert@greenie.muc.de> +Date: Tue Jun 13 22:08:32 2017 +0200 + + Fix remotely-triggerable ASSERT() on malformed IPv6 packet. + + Correct sanity checks on IPv6 packet length in mss_fixup_ipv6(), + and change the ASSERT() check in mss_fixup_dowork() into a simple + "return" (= the TCP header will simply not be inspected further). + + CVE-2017-7508 has been assigned due to the serious nature of the + bug: it can be used to remotely shutdown an openvpn server or + client, if IPv6 and --mssfix are enabled and the IPv6 networks used + inside the VPN are known. + + Found by Guido Vranken <guidovranken@gmail.com>. + + v2: style changes + + CVE: 2017-7508 + Signed-off-by: Gert Doering <gert@greenie.muc.de> + Acked-by: Steffan Karger <steffan.karger@fox-it.com> + Message-Id: <20170613200832.15027-1-gert@greenie.muc.de> + URL: https://www.mail-archive.com/search?l=mid&q=20170613200832.15027-1-gert@greenie.muc.de + Signed-off-by: Gert Doering <gert@greenie.muc.de> + (cherry picked from commit c3f47077a7756de5929094569421a95aa66f2022) + +diff --git a/src/openvpn/mss.c b/src/openvpn/mss.c +index f930942a..c91751d1 100644 +--- a/src/openvpn/mss.c ++++ b/src/openvpn/mss.c +@@ -110,8 +110,12 @@ mss_fixup_ipv6 (struct buffer *buf, int maxmss) + if ( pip6->nexthdr != OPENVPN_IPPROTO_TCP ) + return; + ++ /* skip IPv6 header (40 bytes), ++ * verify remainder is large enough to contain a full TCP header ++ */ + newbuf = *buf; +- if ( buf_advance( &newbuf, 40 ) ) ++ if (buf_advance( &newbuf, 40 ) ++ && BLEN(&newbuf) >= (int) sizeof(struct openvpn_tcphdr)) + { + struct openvpn_tcphdr *tc = (struct openvpn_tcphdr *) BPTR (&newbuf); + if (tc->flags & OPENVPN_TCPH_SYN_MASK) +@@ -133,7 +137,10 @@ mss_fixup_dowork (struct buffer *buf, uint16_t maxmss) + int accumulate; + struct openvpn_tcphdr *tc; + +- ASSERT (BLEN (buf) >= (int) sizeof (struct openvpn_tcphdr)); ++ if (BLEN(buf) < (int) sizeof(struct openvpn_tcphdr)) ++ { ++ return; ++ } + + verify_align_4 (buf); + tc = (struct openvpn_tcphdr *) BPTR (buf); |