Details about the vulnerability (CVE-2024-5594) in the OpenVPN package for creating virtual private networks have been revealed, which can lead to the injection of arbitrary data into external executable files or plugins in the system on the other side of the connection. The vulnerability is caused by the lack of checks for null bytes and invalid characters when processing control messages, such as PUSH_REPLY.
The problem has been fixed in OpenVPN releases 2.5.11 and 2.6.11, released in June 2024. In the release notes, the vulnerability was described as a minor issue, leading to the logging of garbage data or increased CPU load. In a recently published update, the issue has been reclassified as critical (severity level 9.1 out of 10).
Details about the exploitation are not yet provided. The fix has been reduced to ceasing the processing of messages with invalid characters and checking for invalid characters throughout the entire buffer, rather than just in the part before the null byte. Checks for special characters and the null byte have been added for the commands "AUTH_FAILED", "PUSH_*", "RESTART", "HALT", "INFO_PRE", "INFO", "CR_RESPONSE", "AUTH_PENDING", and "EXIT."
Bron: opennet.ru
