Details regarding the vulnerability (CVE-2024-5594) in the OpenVPN private network creation package have been revealed. This can lead to the injection of arbitrary data into external executable files or plugins on the other end of the connection. The vulnerability arises from a lack of validation of null bytes and incorrect characters when processing control messages such as PUSH_REPLY.
The issue has been resolved in the OpenVPN releases 2.5.11 and 2.6.11, released in June 2024. In the release notes, the vulnerability was considered a minor issue that resulted in garbage data being written to logs or an increase in CPU load. In a recent update published a few days ago, the problem has been escalated to critical (danger level 9.1 out of 10).
Details on the exploitation are not yet provided. The fix involves halting the processing of messages with incorrect characters and validating incorrect characters across the entire buffer, not just in the part before the null byte. Validation for special characters and null bytes has been added for the commands 'AUTH_FAILED', 'PUSH_*', 'RESTART', 'HALT', 'INFO_PRE', 'INFO', 'CR_RESPONSE', 'AUTH_PENDING', and 'EXIT'.
Quelle: opennet.ru
