Information has been revealed about a vulnerability (CVE-2024-5594) in the OpenVPN virtual private network package, which may allow arbitrary data to be injected into third-party executable files or plugins on the other end of the connection. The vulnerability is caused by a lack of null byte checks and inappropriate characters when handling control messages such as PUSH_REPLY.
The issue has been resolved in the OpenVPN versions 2.5.11 and 2.6.11, released in June 2024. In the release notes, the vulnerability was described as a minor issue that could lead to garbage data being logged or increased CPU load. In a recent update published a few days ago, the issue has been classified as critical (with a severity level of 9.1 out of 10).
Details of the exploit are not yet provided. The fix involves stopping the processing of messages with inappropriate characters and checking for erroneous characters throughout the entire buffer, not just up to the null byte. Checks for special characters and null bytes have been added for the commands 'AUTH_FAILED', 'PUSH_*', 'RESTART', 'HALT', 'INFO_PRE', 'INFO', 'CR_RESPONSE', 'AUTH_PENDING', and 'EXIT'.
KĂ€lla: opennet.ru
