Import Debian changes 2.3.4-5+deb8u2debian/2.3.4-5+deb8u2

openvpn (2.3.4-5+deb8u2) jessie-security; urgency=high

  * SECURITY UPDATE: authenticated remote DoS vulnerability due to
    packet ID rollover. CVE-2017-7479.
    Kudos to Steve Beattie <sbeattie@ubuntu.com> for doing all the backporting
    work for this patch.
    - debian/patches/CVE-2017-7479-prereq.patch: merge
      packet_id_alloc_outgoing() into packet_id_write()
    - debian/patches/CVE-2017-7479.patch: do not assert when packet ID
      rollover occurs
  * SECURITY UPDATE: (Closes: #865480)
    - CVE-2017-7508.patch. Fix remotely-triggerable ASSERT() on malformed IPv6
      packet.
    - CVE-2017-7520.patch. Prevent two kinds of stack buffer OOB reads and a
      crash for invalid input data.
    - CVE-2017-7521.patch. Fix potential double-free in --x509-alt-username.
    - CVE-2017-7521bis.patch. Fix remote-triggerable memory leaks.

1 files changed, 48 insertions, 0 deletions

diff --git a/debian/patches/CVE-2017-7521.patch b/debian/patches/CVE-2017-7521.patch
new file mode 100644
index 0000000..085550c
--- /dev/null
+++ b/debian/patches/CVE-2017-7521.patch
@@ -0,0 +1,48 @@
+commit 1dde0cd6e5e6a0f2f45ec9969b7ff1b6537514ad
+Author: Steffan Karger <steffan.karger@fox-it.com>
+Date:   Mon Jun 19 11:28:40 2017 +0200
+
+    Fix potential double-free in --x509-alt-username (CVE-2017-7521)
+    
+    We didn't check the return value of ASN1_STRING_to_UTF8() in
+    extract_x509_extension().  Ignoring such a failure could result in buf
+    being free'd twice.  An error in ASN1_STRING_to_UTF8() can be caused
+    remotely if the peer can make the local process run out of memory.
+    
+    The problem can only be triggered for configurations that use the
+    --x509-alt-username option with an x509 extension (i.e. the option
+    parameter starts with "ext:").
+    
+    This issue was discovered, analysed and reported to the OpenVPN team by
+    Guido Vranken.
+    
+    Extensive testing by Guido Vranken gives confidence that this function
+    is very unlikely to fail in real-world usage (using subjectAltName or
+    issuerAltName extensions) for other reasons than memory exhaustion.
+    
+    CVE: 2017-7521
+    Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
+    Acked-by: Gert Doering <gert@greenie.muc.de>
+    Acked-by: David Sommerseth <davids@openvpn.net>
+    Acked-by: Guido Vranken <guidovranken@gmail.com>
+    Message-Id: <1497864520-12219-6-git-send-email-steffan.karger@fox-it.com>
+    URL: https://www.mail-archive.com/search?l=mid&q=1497864520-12219-6-git-send-email-steffan.karger@fox-it.com
+    Signed-off-by: Gert Doering <gert@greenie.muc.de>
+    (cherry picked from commit cb4e35ece4a5b70b10ef9013be3bff263d82f32b)
+
+Index: openvpn-2.3.4/src/openvpn/ssl_verify_openssl.c
+===================================================================
+--- openvpn-2.3.4.orig/src/openvpn/ssl_verify_openssl.c
++++ openvpn-2.3.4/src/openvpn/ssl_verify_openssl.c
+@@ -124,7 +124,10 @@ bool extract_x509_extension(X509 *cert,
+           switch (name->type)
+             {
+               case GEN_EMAIL:
+-                ASN1_STRING_to_UTF8((unsigned char**)&buf, name->d.ia5);
++                if (ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5) < 0)
++                  {
++                    continue;
++                  }
+                 if ( strlen (buf) != name->d.ia5->length )
+                   {
+                     msg (D_TLS_ERRORS, "ASN1 ERROR: string contained terminating zero");