Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (application crash) via a long (1) hostname, (2) path, or (3) cookie list in a response.

This version update fixes several bugs :

  - Frequent connection drops fixed (bnc#817152).

  - Update to version 4.09

  - Fix overflow on HTTP request buffers     (CVE-2012-6128)(bnc#803347)

  - Fix connection to servers with round-robin DNS with     two-stage auth/connect.

  - Impose minimum MTU of 1280 bytes.

  - Fix some harmless issues reported by Coverity.

  - Improve 'Attempting to connect...' message to be     explicit when it's connecting to a proxy.

  - Update to version 4.07

  - Fix segmentation fault when invoked with -p argument.

  - Fix handling of write stalls on CSTP (TCP) socket.

  - Update to version 4.06

  - Fix default CA location for non-Fedora systems with old     GnuTLS.

  - Improve error handing when vpnc-script exits with error.

  - Handle PKCS#11 tokens which won't list keys without     login.

  - Update to version 4.05

  - Use correct CSD script for Mac OS X.

  - Fix endless loop in PIN cache handling with multiple     PKCS#11 tokens.

  - Fix PKCS#11 URI handling to preserve all attributes.

  - Don't forget key password on GUI reconnect.

  - Fix GnuTLS v3 build on OpenBSD.

  - Update to version 4.04

  - Fix GnuTLS password handling for PKCS#8 files.

  - Update to version 4.03

  - Fix --no-proxy option.

  - Fix handling of requested vs. received MTU settings.

  - Fix DTLS MTU for GnuTLS 3.0.21 and newer.

  - Support more ciphers for OpenSSL encrypted PEM keys,     with GnuTLS.

  - Fix GnuTLS compatibility issue with servers that insist     on TLSv1.0 or non-AES ciphers (RH#836558).

  - Update to version 4.02

  - Fix build failure due to unconditional inclusion of     <gnutls/dtls.h>.

  - Update to version 4.01

  - Add support for OpenSSL's odd encrypted PKCS#1 files,     for GnuTLS.

  - Fix repeated passphrase retry for OpenSSL.

  - Add keystore support for Android.

  - Support TPM, and also additional checks on PKCS#11     certs, even with GnuTLS 2.12.

  - Fix library references to OpenSSL's     ERR_print_errors_cb() when built against GnuTLS v2.12.

  - Update to version 4.00

  - Add support for OpenSSL's odd encrypted PKCS#1 files,     for GnuTLS.

  - Fix repeated passphrase retry for OpenSSL.

  - Add keystore support for Android.

  - Support TPM, and also additional checks on PKCS#11     certs, even with GnuTLS 2.12.

  - Fix library references to OpenSSL's     ERR_print_errors_cb() when built against GnuTLS v2.12.

The remote host is affected by the vulnerability described in GLSA-201405-18 (OpenConnect: User-assisted execution of arbitrary code)

    A stack-based buffer overflow error has been discovered in OpenConnect.
  Impact :

    A remote attacker could entice a user to connect to a malicious VPN       server, possibly resulting in  execution of arbitrary code with the       privileges of the process, or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Updated openconnect packages fix security vulnerability :

A stack-based buffer overflow flaw was found in the way OpenConnect, a client for Cisco's AnyConnect VPN, performed processing of certain host names, paths, or cookie lists, received from the VPN gateway. A remote VPN gateway could provide a specially crafted host name, path or cookie list that, when processed by the openconnect client would lead to openconnect executable crash (CVE-2012-6128).

This update fixes a potential buffer overflow in HTTP request generation, which could be triggered by a malicious server generating a large number of cookies or redirecting to a large path or hostname.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Kevin Cernekee discovered that a malicious VPN gateway can send crafted responses which trigger stack-based buffer overflows.

ID	Name	Product	Family	Severity
75002	openSUSE Security Update : openconnect (openSUSE-SU-2013:0979-1)	Nessus	SuSE Local Security Checks	medium
74060	GLSA-201405-18 : OpenConnect: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
66120	Mandriva Linux Security Advisory : openconnect (MDVSA-2013:108)	Nessus	Mandriva Local Security Checks	medium
64871	Fedora 18 : openconnect-4.08-1.fc18 (2013-2498)	Nessus	Fedora Local Security Checks	medium
64870	Fedora 17 : openconnect-4.08-1.fc17 (2013-2472)	Nessus	Fedora Local Security Checks	medium
64635	Debian DSA-2623-1 : openconnect - buffer overflow	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-6128

high

Tenable Plugins

medium

medium

medium

medium

medium

medium