upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-05-28 04:03:29 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

openssl: fix overflow check for long --tls-cipher option

Browse source 
The length check in tls_ctx_restrict_ciphers() did not check for overflow,
which could lead to a stack buffer overflow.

This has no real-world impact, because --tls-cipher can only be specified
by entities that are allowed to supply config settings.  Since those
entities can also change --script-security and call scripts and/or
plugins, these users already have code execution at the level of the
openvpn process.  In other words: the attacker would not gain any
capabilities.  Nevertheless, a nasty bug that we should fix.

This bug was discovered and reported to the OpenVPN security team by
Guido Vranken.

Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1495461253-20111-1-git-send-email-steffan.karger@fox-it.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg14716.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
This commit is contained in:
Steffan Karger 2017-05-22 15:54:13 +02:00 committed by Gert Doering
parent 534c8f24bd
commit e6bf7e033d
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/openvpn/ssl_openssl.c
View file

@ -352,7 +352,8 @@ tls_ctx_restrict_ciphers(struct tls_root_ctx *ctx, const char *ciphers)
}
/* Make sure new cipher name fits in cipher string */
if (((sizeof(openssl_ciphers)-1) - openssl_ciphers_len) < current_cipher_len)
if ((SIZE_MAX - openssl_ciphers_len) < current_cipher_len
|| ((sizeof(openssl_ciphers)-1) < openssl_ciphers_len + current_cipher_len))
{
msg(M_FATAL,
"Failed to set restricted TLS cipher list, too long (>%d).",