diff options
| author | Steffan Karger | 2017-08-15 10:04:33 +0200 |
|---|---|---|
| committer | David Sommerseth | 2017-09-22 01:27:19 +0200 |
| commit | fce34375295151f548a26c2d0eb30141e427c81a (patch) | |
| tree | af5ac6123c94ca906cce6f729f4927aeec922452 /Changes.rst | |
| parent | 5071f6783ae1cd248cfc9634d76ed1ecad851f5b (diff) | |
| download | openvpn-fce34375295151f548a26c2d0eb30141e427c81a.zip openvpn-fce34375295151f548a26c2d0eb30141e427c81a.tar.gz | |
Fix bounds check in read_key()
The bounds check in read_key() was performed after using the value, instead
of before. If 'key-method 1' is used, this allowed an attacker to send a
malformed packet to trigger a stack buffer overflow.
Fix this by moving the input validation to before the writes.
Note that 'key-method 1' has been replaced by 'key method 2' as the default
in OpenVPN 2.0 (released on 2005-04-17), and explicitly deprecated in 2.4
and marked for removal in 2.5. This should limit the amount of users
impacted by this issue.
CVE: 2017-12166
Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Acked-by: David Sommerseth <davids@openvpn.net>
Message-Id: <80690690-67ac-3320-1891-9fecedc6a1fa@fox-it.com>
URL: https://www.mail-archive.com/search?l=mid&q=80690690-67ac-3320-1891-9fecedc6a1fa@fox-it.com
Signed-off-by: David Sommerseth <davids@openvpn.net>
(backport of git master commit 3b1a61e9fb27213c46f76312f4065816bee8ed01)
Diffstat (limited to 'Changes.rst')
0 files changed, 0 insertions, 0 deletions