]> git.ipfire.org Git - thirdparty/openvpn.git/commit
Fix bounds check in read_key() release/2.1
authorSteffan Karger <steffan.karger@fox-it.com>
Tue, 15 Aug 2017 08:04:33 +0000 (10:04 +0200)
committerDavid Sommerseth <davids@openvpn.net>
Thu, 21 Sep 2017 23:31:22 +0000 (01:31 +0200)
commitc560f95e7038daa3a1b5a08b69b85fb68d4eeef3
tree18897bdf6f33aaf5b72c6720a69d29339067670c
parent244c9681aed7b9fbdbd14842a79d686c83cc6db7
Fix bounds check in read_key()

The bounds check in read_key() was performed after using the value, instead
of before.  If 'key-method 1' is used, this allowed an attacker to send a
malformed packet to trigger a stack buffer overflow.

Fix this by moving the input validation to before the writes.

Note that 'key-method 1' has been replaced by 'key method 2' as the default
in OpenVPN 2.0 (released on 2005-04-17), and explicitly deprecated in 2.4
and marked for removal in 2.5.  This should limit the amount of users
impacted by this issue.

CVE: 2017-12166
Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Acked-by: David Sommerseth <davids@openvpn.net>
Message-Id: <80690690-67ac-3320-1891-9fecedc6a1fa@fox-it.com>
URL: https://www.mail-archive.com/search?l=mid&q=80690690-67ac-3320-1891-9fecedc6a1fa@fox-it.com
Signed-off-by: David Sommerseth <davids@openvpn.net>
(cherry picked from commit fce34375295151f548a26c2d0eb30141e427c81a)
crypto.c