Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 632108 (CVE-2017-12166) - <net-vpn/openvpn-2.4.4: Stack overflow for --key-method 1 config
Summary: <net-vpn/openvpn-2.4.4: Stack overflow for --key-method 1 config
Status: RESOLVED FIXED
Alias: CVE-2017-12166
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://github.com/OpenVPN/openvpn/bl...
Whiteboard: C3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-09-26 21:56 UTC by Manuel Rüger (RETIRED)
Modified: 2018-03-24 00:02 UTC (History)
2 users (show)

See Also:
Package list:
net-vpn/openvpn-2.4.4
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Manuel Rüger (RETIRED) gentoo-dev 2017-09-26 21:56:15 UTC 
CVE-2017-12166: Fix bounds check for configurations using --key-method 1. Before this fix, it could allow an attacker to send a malformed packet to trigger a stack overflow. This is considered to be a low risk issue, as --key-method 2 has been the default since OpenVPN 2.0 (released on 2005-04-17). This option is already deprecated in v2.4 and will be completely removed in v2.5.


Fixed in 2.4.4, which will arrive in ::gentoo shortly
Comment 1 Manuel Rüger (RETIRED) gentoo-dev 2017-09-26 22:06:24 UTC 
commit da95c4cdb346e34ea502c71d1c53672045ac6a98 (HEAD -> master, origin/master, origin/HEAD)
Author: Manuel Rüger <mrueg@gentoo.org>
Date:   Wed Sep 27 00:05:43 2017 +0200

    net-vpn/openvpn: Version bump to 2.4.4
    
    Package-Manager: Portage-2.3.10, Repoman-2.3.2
Comment 2 Manuel Rüger (RETIRED) gentoo-dev 2017-09-27 09:57:13 UTC 
Arches please test and mark stable
Comment 3 Agostino Sarubbo gentoo-dev 2017-09-27 11:21:21 UTC 
amd64 stable
Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev 2017-09-29 23:06:22 UTC 
x86 stable
Comment 5 Sergei Trofimovich (RETIRED) gentoo-dev 2017-09-30 03:00:57 UTC 
ppc64 stable
Comment 6 Sergei Trofimovich (RETIRED) gentoo-dev 2017-09-30 04:14:45 UTC 
ppc stable
Comment 7 Sergei Trofimovich (RETIRED) gentoo-dev 2017-09-30 07:22:02 UTC 
ia64 stable
Comment 8 Sergei Trofimovich (RETIRED) gentoo-dev 2017-10-03 08:38:50 UTC 
hppa stable
Comment 9 Markus Meier gentoo-dev 2017-10-16 18:14:03 UTC 
arm stable
Comment 10 Tobias Klausmann (RETIRED) gentoo-dev 2017-10-22 21:50:33 UTC 
Stable on alpha.
Comment 11 Aaron Bauman (RETIRED) gentoo-dev 2017-10-23 00:00:42 UTC 
GLSA Vote: No

@maintainers, please clean the vulnerable versions.
Comment 12 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2018-03-18 15:46:12 UTC 
@Maintainers ping.
Comment 13 Aaron Bauman (RETIRED) gentoo-dev 2018-03-24 00:02:44 UTC 
tree is clean.  Thanks, William!