From 3e3e9b32519a38f9316986b877163d37557b4f70 Mon Sep 17 00:00:00 2001 From: Alberto Gonzalez Iniesta Date: Thu, 22 Jun 2017 17:25:13 +0200 Subject: Import Debian changes 2.3.4-5+deb8u2 openvpn (2.3.4-5+deb8u2) jessie-security; urgency=high * SECURITY UPDATE: authenticated remote DoS vulnerability due to packet ID rollover. CVE-2017-7479. Kudos to Steve Beattie for doing all the backporting work for this patch. - debian/patches/CVE-2017-7479-prereq.patch: merge packet_id_alloc_outgoing() into packet_id_write() - debian/patches/CVE-2017-7479.patch: do not assert when packet ID rollover occurs * SECURITY UPDATE: (Closes: #865480) - CVE-2017-7508.patch. Fix remotely-triggerable ASSERT() on malformed IPv6 packet. - CVE-2017-7520.patch. Prevent two kinds of stack buffer OOB reads and a crash for invalid input data. - CVE-2017-7521.patch. Fix potential double-free in --x509-alt-username. - CVE-2017-7521bis.patch. Fix remote-triggerable memory leaks. --- debian/patches/CVE-2017-7521.patch | 48 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 debian/patches/CVE-2017-7521.patch (limited to 'debian/patches/CVE-2017-7521.patch') diff --git a/debian/patches/CVE-2017-7521.patch b/debian/patches/CVE-2017-7521.patch new file mode 100644 index 0000000..085550c --- /dev/null +++ b/debian/patches/CVE-2017-7521.patch @@ -0,0 +1,48 @@ +commit 1dde0cd6e5e6a0f2f45ec9969b7ff1b6537514ad +Author: Steffan Karger +Date: Mon Jun 19 11:28:40 2017 +0200 + + Fix potential double-free in --x509-alt-username (CVE-2017-7521) + + We didn't check the return value of ASN1_STRING_to_UTF8() in + extract_x509_extension(). Ignoring such a failure could result in buf + being free'd twice. An error in ASN1_STRING_to_UTF8() can be caused + remotely if the peer can make the local process run out of memory. + + The problem can only be triggered for configurations that use the + --x509-alt-username option with an x509 extension (i.e. the option + parameter starts with "ext:"). + + This issue was discovered, analysed and reported to the OpenVPN team by + Guido Vranken. + + Extensive testing by Guido Vranken gives confidence that this function + is very unlikely to fail in real-world usage (using subjectAltName or + issuerAltName extensions) for other reasons than memory exhaustion. + + CVE: 2017-7521 + Signed-off-by: Steffan Karger + Acked-by: Gert Doering + Acked-by: David Sommerseth + Acked-by: Guido Vranken + Message-Id: <1497864520-12219-6-git-send-email-steffan.karger@fox-it.com> + URL: https://www.mail-archive.com/search?l=mid&q=1497864520-12219-6-git-send-email-steffan.karger@fox-it.com + Signed-off-by: Gert Doering + (cherry picked from commit cb4e35ece4a5b70b10ef9013be3bff263d82f32b) + +Index: openvpn-2.3.4/src/openvpn/ssl_verify_openssl.c +=================================================================== +--- openvpn-2.3.4.orig/src/openvpn/ssl_verify_openssl.c ++++ openvpn-2.3.4/src/openvpn/ssl_verify_openssl.c +@@ -124,7 +124,10 @@ bool extract_x509_extension(X509 *cert, + switch (name->type) + { + case GEN_EMAIL: +- ASN1_STRING_to_UTF8((unsigned char**)&buf, name->d.ia5); ++ if (ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5) < 0) ++ { ++ continue; ++ } + if ( strlen (buf) != name->d.ia5->length ) + { + msg (D_TLS_ERRORS, "ASN1 ERROR: string contained terminating zero"); -- cgit v1.2.3