Hello community,
here is the log from the commit of package openvpn for openSUSE:Factory checked
in at 2017-10-11 23:02:04
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/openvpn (Old)
and /work/SRC/openSUSE:Factory/.openvpn.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openvpn"
Wed Oct 11 23:02:04 2017 rev:78 rq:533032 version:2.4.3
Changes:
--------
--- /work/SRC/openSUSE:Factory/openvpn/openvpn.changes 2017-10-05
12:05:47.721421506 +0200
+++ /work/SRC/openSUSE:Factory/.openvpn.new/openvpn.changes 2017-10-11
23:02:07.986852519 +0200
@@ -1,0 +2,6 @@
+Tue Oct 10 14:10:30 CEST 2017 - n...@suse.de
+
+- Do bound check in read_key before using values(CVE-2017-12166 bsc#1060877).
+ [+ 0002-Fix-bounds-check-in-read_key.patch]
+
+-------------------------------------------------------------------
New:
----
0002-Fix-bounds-check-in-read_key.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ openvpn.spec ++++++
--- /var/tmp/diff_new_pack.WdjALE/_old 2017-10-11 23:02:09.738775765 +0200
+++ /var/tmp/diff_new_pack.WdjALE/_new 2017-10-11 23:02:09.754775064 +0200
@@ -54,6 +54,7 @@
Patch7: openvpn-2.3.9-Fix-heap-overflow-on-getaddrinfo-result.patch
Patch8: openvpn-2.3.x-fixed-multiple-low-severity-issues.patch
Patch9: 0001-preform-deferred-authentication-in-the-background.patch
+Patch10: 0002-Fix-bounds-check-in-read_key.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: iproute2
BuildRequires: lzo-devel
@@ -141,6 +142,7 @@
%patch7 -p1
%patch8 -p1
%patch9 -p1
+%patch10 -p1
sed -e "s|\" __DATE__|$(date '+%b %e %Y' -r version.m4)\"|g" \
-i src/openvpn/options.c
++++++ 0002-Fix-bounds-check-in-read_key.patch ++++++
>From 3b1a61e9fb27213c46f76312f4065816bee8ed01 Mon Sep 17 00:00:00 2001
From: Steffan Karger <steffan.kar...@fox-it.com>
Date: Tue, 15 Aug 2017 10:04:33 +0200
Subject: [PATCH] Fix bounds check in read_key()
The bounds check in read_key() was performed after using the value, instead
of before. If 'key-method 1' is used, this allowed an attacker to send a
malformed packet to trigger a stack buffer overflow.
Fix this by moving the input validation to before the writes.
Note that 'key-method 1' has been replaced by 'key method 2' as the default
in OpenVPN 2.0 (released on 2005-04-17), and explicitly deprecated in 2.4
and marked for removal in 2.5. This should limit the amount of users
impacted by this issue.
CVE: 2017-12166
Signed-off-by: Steffan Karger <steffan.kar...@fox-it.com>
Acked-by: Gert Doering <g...@greenie.muc.de>
Acked-by: David Sommerseth <dav...@openvpn.net>
Message-Id: <80690690-67ac-3320-1891-9fecedc6a...@fox-it.com>
URL:
https://www.mail-archive.com/search?l=mid&q=80690690-67ac-3320-1891-9fecedc6a...@fox-it.com
Signed-off-by: David Sommerseth <dav...@openvpn.net>
---
src/openvpn/crypto.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 131257e5..3f3caa1c 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -1666,6 +1666,11 @@ read_key(struct key *key, const struct key_type *kt,
struct buffer *buf)
goto read_err;
}
+ if (cipher_length != kt->cipher_length || hmac_length != kt->hmac_length)
+ {
+ goto key_len_err;
+ }
+
if (!buf_read(buf, key->cipher, cipher_length))
{
goto read_err;
@@ -1675,11 +1680,6 @@ read_key(struct key *key, const struct key_type *kt,
struct buffer *buf)
goto read_err;
}
- if (cipher_length != kt->cipher_length || hmac_length != kt->hmac_length)
- {
- goto key_len_err;
- }
-
return 1;
read_err:
--
2.13.6
