Merge branch 'stretch' of ssh://git.debian.org/git/collab-maint/openvpn into stretchstretch

6 files changed, 270 insertions, 0 deletions

diff --git a/debian/patches/812-fix-push-options-digest-update.patch b/debian/patches/812-fix-push-options-digest-update.patch
new file mode 100644
index 0000000..f79a27c
--- /dev/null
+++ b/debian/patches/812-fix-push-options-digest-update.patch
@@ -0,0 +1,31 @@
+From: Selva Nair <selva.nair@gmail.com>
+Date: Tue, 3 Jan 2017 16:42:18 -0500
+Subject: [PATCH] Fix push options digest update
+Bug: https://community.openvpn.net/openvpn/ticket/812
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863110
+
+Trac: #812
+
+Signed-off-by: Selva Nair <selva.nair@gmail.com>
+Acked-by: Steffan Karger <steffan.karger@fox-it.com>
+Message-Id: <1483479738-17672-1-git-send-email-selva.nair@gmail.com>
+URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg13816.html
+Signed-off-by: Gert Doering <gert@greenie.muc.de>
+---
+ src/openvpn/push.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/openvpn/push.c b/src/openvpn/push.c
+index f5154756a..c9c04a630 100644
+--- a/src/openvpn/push.c
++++ b/src/openvpn/push.c
+@@ -692,8 +692,8 @@ push_update_digest(md_ctx_t *ctx, struct buffer *buf, const struct options *opt)
+         {
+             continue;
+         }
++        md_ctx_update(ctx, (const uint8_t *) line, strlen(line)+1);
+     }
+-    md_ctx_update(ctx, (const uint8_t *) line, strlen(line)+1);
+ }
+ 
+ int
diff --git a/debian/patches/CVE-2017-7508.patch b/debian/patches/CVE-2017-7508.patch
new file mode 100644
index 0000000..6ba80ac
--- /dev/null
+++ b/debian/patches/CVE-2017-7508.patch
@@ -0,0 +1,57 @@
+commit ed28cde3d8bf3f1459b2f42f0e27d64801009f92
+Author: Gert Doering <gert@greenie.muc.de>
+Date:   Tue Jun 13 22:08:32 2017 +0200
+
+    Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
+    
+    Correct sanity checks on IPv6 packet length in mss_fixup_ipv6(),
+    and change the ASSERT() check in mss_fixup_dowork() into a simple
+    "return" (= the TCP header will simply not be inspected further).
+    
+    CVE-2017-7508 has been assigned due to the serious nature of the
+    bug: it can be used to remotely shutdown an openvpn server or
+    client, if IPv6 and --mssfix are enabled and the IPv6 networks used
+    inside the VPN are known.
+    
+    Found by Guido Vranken <guidovranken@gmail.com>.
+    
+    v2: style changes
+    
+    CVE: 2017-7508
+    Signed-off-by: Gert Doering <gert@greenie.muc.de>
+    Acked-by: Steffan Karger <steffan.karger@fox-it.com>
+    Message-Id: <20170613200832.15027-1-gert@greenie.muc.de>
+    URL: https://www.mail-archive.com/search?l=mid&q=20170613200832.15027-1-gert@greenie.muc.de
+    Signed-off-by: Gert Doering <gert@greenie.muc.de>
+    (cherry picked from commit c3f47077a7756de5929094569421a95aa66f2022)
+
+Index: openvpn-2.4.0/src/openvpn/mss.c
+===================================================================
+--- openvpn-2.4.0.orig/src/openvpn/mss.c
++++ openvpn-2.4.0/src/openvpn/mss.c
+@@ -120,8 +120,12 @@ mss_fixup_ipv6(struct buffer *buf, int m
+         return;
+     }
+ 
++    /* skip IPv6 header (40 bytes),
++     * verify remainder is large enough to contain a full TCP header
++     */
+     newbuf = *buf;
+-    if (buf_advance( &newbuf, 40 ) )
++    if (buf_advance( &newbuf, 40 )
++        && BLEN(&newbuf) >= (int) sizeof(struct openvpn_tcphdr))
+     {
+         struct openvpn_tcphdr *tc = (struct openvpn_tcphdr *) BPTR(&newbuf);
+         if (tc->flags & OPENVPN_TCPH_SYN_MASK)
+@@ -145,7 +149,10 @@ mss_fixup_dowork(struct buffer *buf, uin
+     int accumulate;
+     struct openvpn_tcphdr *tc;
+ 
+-    ASSERT(BLEN(buf) >= (int) sizeof(struct openvpn_tcphdr));
++    if (BLEN(buf) < (int) sizeof(struct openvpn_tcphdr))
++    {
++	return;
++    }
+ 
+     verify_align_4(buf);
+     tc = (struct openvpn_tcphdr *) BPTR(buf);
diff --git a/debian/patches/CVE-2017-7520.patch b/debian/patches/CVE-2017-7520.patch
new file mode 100644
index 0000000..2152517
--- /dev/null
+++ b/debian/patches/CVE-2017-7520.patch
@@ -0,0 +1,55 @@
+commit 043fe327878eba75efa13794c9845f85c3c629f2
+Author: Guido Vranken <guidovranken@gmail.com>
+Date:   Fri May 19 14:04:25 2017 +0200
+
+    Prevent two kinds of stack buffer OOB reads and a crash for invalid input data
+    
+    Pre-authentication remote crash/information disclosure for clients
+    
+    If clients use a HTTP proxy with NTLM authentication (i.e.
+    "--http-proxy <server> <port> [<authfile>|'auto'|'auto-nct'] ntlm2"),
+    a man-in-the-middle attacker between the client and the proxy can
+    cause the client to crash or disclose at most 96 bytes of stack
+    memory. The disclosed stack memory is likely to contain the proxy
+    password.
+    
+    If the proxy password is not reused, this is unlikely to compromise
+    the security of the OpenVPN tunnel itself.  Clients who do not use
+    the --http-proxy option with ntlm2 authentication are not affected.
+    
+    CVE: 2017-7520
+    Signed-off-by: Guido Vranken <guidovranken@gmail.com>
+    Acked-by: Gert Doering <gert@greenie.muc.de>
+    Message-Id: <CAO5O-EJvHKid-zTj+hmFG_3Gv78ixqCayE9=C62DZaxN32WNtQ@mail.gmail.com>
+    URL: https://www.mail-archive.com/search?l=mid&q=CAO5O-EJvHKid-zTj+hmFG_3Gv78ixqCayE9=C62DZaxN32WNtQ@mail.gmail.com
+    Signed-off-by: Gert Doering <gert@greenie.muc.de>
+    (cherry picked from commit 7718c8984f04b507c1885f363970e2124e3c6c77)
+
+Index: openvpn-2.4.0/src/openvpn/ntlm.c
+===================================================================
+--- openvpn-2.4.0.orig/src/openvpn/ntlm.c
++++ openvpn-2.4.0/src/openvpn/ntlm.c
+@@ -193,7 +193,7 @@ ntlm_phase_3(const struct http_proxy_inf
+      */
+ 
+     char pwbuf[sizeof(p->up.password) * 2]; /* for unicode password */
+-    char buf2[128]; /* decoded reply from proxy */
++    unsigned char buf2[128]; /* decoded reply from proxy */
+     unsigned char phase3[464];
+ 
+     char md4_hash[MD4_DIGEST_LENGTH+5];
+@@ -299,7 +299,13 @@ ntlm_phase_3(const struct http_proxy_inf
+                 tib_len = 96;
+             }
+             {
+-                char *tib_ptr = buf2 + buf2[0x2c];           /* Get Target Information block pointer */
++                char *tib_ptr;
++                int tib_pos = buf2[0x2c];
++                if (tib_pos + tib_len > sizeof(buf2))
++                {
++                    return NULL;
++                }
++                tib_ptr = buf2 + tib_pos;                               /* Get Target Information block pointer */
+                 memcpy(&ntlmv2_blob[0x1c], tib_ptr, tib_len);           /* Copy Target Information block into the blob */
+             }
+         }
diff --git a/debian/patches/CVE-2017-7521.patch b/debian/patches/CVE-2017-7521.patch
new file mode 100644
index 0000000..574ab4b
--- /dev/null
+++ b/debian/patches/CVE-2017-7521.patch
@@ -0,0 +1,48 @@
+commit 040084067119dd5a9e15eb3bcfc0079debaa3777
+Author: Steffan Karger <steffan.karger@fox-it.com>
+Date:   Mon Jun 19 11:28:40 2017 +0200
+
+    Fix potential double-free in --x509-alt-username (CVE-2017-7521)
+    
+    We didn't check the return value of ASN1_STRING_to_UTF8() in
+    extract_x509_extension().  Ignoring such a failure could result in buf
+    being free'd twice.  An error in ASN1_STRING_to_UTF8() can be caused
+    remotely if the peer can make the local process run out of memory.
+    
+    The problem can only be triggered for configurations that use the
+    --x509-alt-username option with an x509 extension (i.e. the option
+    parameter starts with "ext:").
+    
+    This issue was discovered, analysed and reported to the OpenVPN team by
+    Guido Vranken.
+    
+    Extensive testing by Guido Vranken gives confidence that this function
+    is very unlikely to fail in real-world usage (using subjectAltName or
+    issuerAltName extensions) for other reasons than memory exhaustion.
+    
+    CVE: 2017-7521
+    Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
+    Acked-by: Gert Doering <gert@greenie.muc.de>
+    Acked-by: David Sommerseth <davids@openvpn.net>
+    Acked-by: Guido Vranken <guidovranken@gmail.com>
+    Message-Id: <1497864520-12219-6-git-send-email-steffan.karger@fox-it.com>
+    URL: https://www.mail-archive.com/search?l=mid&q=1497864520-12219-6-git-send-email-steffan.karger@fox-it.com
+    Signed-off-by: Gert Doering <gert@greenie.muc.de>
+    (cherry picked from commit cb4e35ece4a5b70b10ef9013be3bff263d82f32b)
+
+Index: openvpn-2.4.0/src/openvpn/ssl_verify_openssl.c
+===================================================================
+--- openvpn-2.4.0.orig/src/openvpn/ssl_verify_openssl.c
++++ openvpn-2.4.0/src/openvpn/ssl_verify_openssl.c
+@@ -142,7 +142,10 @@ extract_x509_extension(X509 *cert, char
+             switch (name->type)
+             {
+                 case GEN_EMAIL:
+-                    ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5);
++                    if (ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5) < 0)
++                    {
++                        continue;
++                    }
+                     if (strlen(buf) != name->d.ia5->length)
+                     {
+                         msg(D_TLS_ERRORS, "ASN1 ERROR: string contained terminating zero");
diff --git a/debian/patches/CVE-2017-7521bis.patch b/debian/patches/CVE-2017-7521bis.patch
new file mode 100644
index 0000000..8f242f8
--- /dev/null
+++ b/debian/patches/CVE-2017-7521bis.patch
@@ -0,0 +1,74 @@
+commit 2341f716198fa90193e040b3fdb16959a47c6c27
+Author: Steffan Karger <steffan.karger@fox-it.com>
+Date:   Mon Jun 19 11:28:38 2017 +0200
+
+    Fix remote-triggerable memory leaks (CVE-2017-7521)
+    
+    Several of our OpenSSL-specific certificate-parsing code paths did not
+    always clear all allocated memory.  Since a client can cause a few bytes
+    of memory to be leaked for each connection attempt, a client can cause a
+    server to run out of memory and thereby kill the server.  That makes this
+    a (quite inefficient) DoS attack.
+    
+    When using the --x509-alt-username option on openssl builds with an
+    extension (argument prefixed with "ext:", e.g. "ext:subjectAltName"), the
+    code would not free all allocated memory.  Fix this by using the proper
+    free function.
+    
+    If ASN1_STRING_to_UTF8() returns 0, it didn't fail and *did* allocate
+    memory.  So also free the returned buffer if it returns 0.
+    
+    These issues were found, analysed and reported to the OpenVPN team by Guido
+    Vranken.
+    
+    CVE: 2017-7521
+    Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
+    Acked-by: Gert Doering <gert@greenie.muc.de>
+    Acked-by: David Sommerseth <davids@openvpn.net>
+    Acked-by: Guido Vranken <guidovranken@gmail.com>
+    Message-Id: <1497864520-12219-4-git-send-email-steffan.karger@fox-it.com>
+    URL: https://www.mail-archive.com/search?l=mid&q=1497864520-12219-4-git-send-email-steffan.karger@fox-it.com
+    Signed-off-by: Gert Doering <gert@greenie.muc.de>
+    (cherry picked from commit 2d032c7fcdfd692c851ea2fa858b4c2d9ea7d52d)
+
+Index: openvpn-2.4.0/src/openvpn/ssl_verify_openssl.c
+===================================================================
+--- openvpn-2.4.0.orig/src/openvpn/ssl_verify_openssl.c
++++ openvpn-2.4.0/src/openvpn/ssl_verify_openssl.c
+@@ -165,7 +165,7 @@ extract_x509_extension(X509 *cert, char
+                     break;
+             }
+         }
+-        sk_GENERAL_NAME_free(extensions);
++        GENERAL_NAMES_free(extensions);
+     }
+     return retval;
+ }
+@@ -218,8 +218,7 @@ extract_x509_field_ssl(X509_NAME *x509,
+     {
+         return FAILURE;
+     }
+-    tmp = ASN1_STRING_to_UTF8(&buf, asn1);
+-    if (tmp <= 0)
++    if (ASN1_STRING_to_UTF8(&buf, asn1) < 0)
+     {
+         return FAILURE;
+     }
+@@ -460,7 +459,7 @@ x509_setenv_track(const struct x509_trac
+                             ASN1_STRING *val = X509_NAME_ENTRY_get_data(ent);
+                             unsigned char *buf;
+                             buf = (unsigned char *)1; /* bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8 requires this workaround */
+-                            if (ASN1_STRING_to_UTF8(&buf, val) > 0)
++                            if (ASN1_STRING_to_UTF8(&buf, val) >= 0)
+                             {
+                                 do_setenv_x509(es, xt->name, (char *)buf, depth);
+                                 OPENSSL_free(buf);
+@@ -548,7 +547,7 @@ x509_setenv(struct env_set *es, int cert
+             continue;
+         }
+         buf = (unsigned char *)1; /* bug in OpenSSL 0.9.6b ASN1_STRING_to_UTF8 requires this workaround */
+-        if (ASN1_STRING_to_UTF8(&buf, val) <= 0)
++        if (ASN1_STRING_to_UTF8(&buf, val) < 0)
+         {
+             continue;
+         }
diff --git a/debian/patches/series b/debian/patches/series
index 907dc15..4357c69 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,3 +8,8 @@ CVE-2017-7479-prereq.patch
 CVE-2017-7479.patch
 wipe_tokens_on_de-auth.patch
 upstream-issue-879.patch
+CVE-2017-7508.patch
+CVE-2017-7520.patch
+CVE-2017-7521.patch
+CVE-2017-7521bis.patch
+812-fix-push-options-digest-update.patch