From: Lev Stipakov Date: Tue, 19 Mar 2024 15:16:07 +0000 (+0200) Subject: interactive.c: disable remote access to the service pipe X-Git-Tag: v2.5.10~2 X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=e0775c042c7908a9b315da8092b436d03abea08a;p=thirdparty%2Fopenvpn.git interactive.c: disable remote access to the service pipe Remote access to the service pipe is not needed and might be a potential attack vector. For example, if an attacker manages to get credentials for a user which is the member of "OpenVPN Administrators" group on a victim machine, an attacker might be able to communicate with the privileged interactive service on a victim machine and start openvpn processes remotely. CVE: 2024-24974 Microsoft case number: 85925 Reported-by: Vladimir Tokarev Change-Id: I8739c5f127e9ca0683fcdbd099dba9896ae46277 Signed-off-by: Lev Stipakov Acked-by: Heiko Hund Message-Id: <20240319151723.936-2-lev@openvpn.net> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg28419.html Signed-off-by: Gert Doering (cherry picked from commit 2c1de0f0803360c0a6408f754066bd3a6fb28237) --- diff --git a/src/openvpnserv/interactive.c b/src/openvpnserv/interactive.c index 3b120ae94..5e3ff1253 100644 --- a/src/openvpnserv/interactive.c +++ b/src/openvpnserv/interactive.c @@ -1994,7 +1994,7 @@ CreateClientPipeInstance(VOID) openvpn_sntprintf(pipe_name, _countof(pipe_name), TEXT("\\\\.\\pipe\\" PACKAGE "%s\\service"), service_instance); pipe = CreateNamedPipe(pipe_name, flags, - PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE, + PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE | PIPE_REJECT_REMOTE_CLIENTS, PIPE_UNLIMITED_INSTANCES, 1024, 1024, 0, NULL); if (pipe == INVALID_HANDLE_VALUE) {