bugtraq - Re: OpenVPN[v2.0.x]: foreign_option() formart string vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0511041543460.15206@localhost>
Date: Fri, 4 Nov 2005 15:46:45 -0500 (EST)
From: v9 <v9@...ehalo.us>
To: James Yonan <jim@...an.net>
Cc: info@...nvpn.net, bugtraq@...urityfocus.com
Subject: Re: OpenVPN[v2.0.x]: foreign_option() formart string vulnerability.

ah, that would be what i did when testing("client"), sorry for the
false/confusion with that... anyways, great software i use it for my vpn
needs...nicely documented and easy to use--thanks for its existence.

> Vade79,
>
> Thanks for your efforts in finding this!  I've just released OpenVPN 2.0.4
> with a fix.
>
> The patch is here:
>
> http://openvpn.net/patch/2.0.4-security-patches/foreign_option.patch
>
> While this patch fixes the format string vulnerability, you made another
> claim as well which I believe to be false:
>
> > however, when testing i did NOT have to have the "pull" option in my clients config
> > file to allow the "push"ed dhcp-option request as it states above.
>
> You didn't post your test configuration file, but I suspect that you were
> using "client" which is a macro that expands to "pull" and "tls-client".
>
> Take a look at this line in push.c:
>
> if (honor_received_options && buf_string_compare_advance (&buf, "PUSH_REPLY"))
>
> This conditional decides whether or not to process a received PUSH_REPLY
> message.  honor_received_options will be false unless "pull" or "client"
> is specified.
>
> James
>
>