[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20151218010019.37009bbd@pc1>
Date: Fri, 18 Dec 2015 01:00:19 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Out of bounds read in OpenVPN before 2.3.9
https://blog.fuzzing-project.org/32-Out-of-bounds-read-in-OpenVPN.html
OpenVPN versions before 2.3.9 contain an out of bounds read error. The
bug happens in the function resolve_remote() in the file socket.c.
I reported this bug to the OpenVPN security team on December 6th. I was
informed that this was already reported to them previously and fixed in
the repository. The new release 2.3.9 fixes this. The current git head
code of OpenVPN has this code part completely reworked, it is thus not
affected.
http://permalink.gmane.org/gmane.network.openvpn.devel/10479
https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.9
The reason for this bug is that for both IPv4 and IPv6 connections
OpenVPN will read a struct sockaddr_in6, but in the IPv4 case the data
structure is smaller than in the IPv6 case. The bug was found by trying
to run OpenVPN with Address Sanitizer.
I don't know whether this is in any way exploitable, but as OpenVPN is
a security sensitive software I found it worthy to make it public.
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
