Penetration Test Report (QuarksLab): OpenVPN1.2final

OpenVPN 2.4.0 Security Assessment
Technical Report
Ref. 17-03-284-REP
Version 1.2
Date 10 May 2017
Prepared for OSTIF
Performed by Quarkslab
Contents
1 Project Information 1
2 Executive Summary 2
3 Context and Scope 4
3.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
3.2 Past Security Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
3.2.1 Cryptographic Weaknesses . . . . . . . . . . . . . . . . . . . . . . . . . . 5
3.2.2 Memory Corruption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
3.2.3 Miscellaneous Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
4 Internal Mechanisms of OpenVPN 7
4.1 Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
4.1.1 Transport Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
4.1.2 Packets Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
4.1.3 Session Establishment and Management . . . . . . . . . . . . . . . . . . 9
4.2 Authentication Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
4.2.1 Static Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
4.2.2 TLS Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
5 Security Problems Identified in OpenVPN 13
5.1 Pre-authentication Denial of Service . . . . . . . . . . . . . . . . . . . . . . . . . 13
5.2 Denial of Service due to Exhaustion of Packet Identifiers . . . . . . . . . . . . . 14
5.3 Invalid Retrieval of X.509 Certificate Fields With mbed TLS . . . . . . . . . . . 15
5.4 Usernames/Passwords not Erased from Memory . . . . . . . . . . . . . . . . . . 16
5.5 Null Pointer Dereference in the Data Compression Stub . . . . . . . . . . . . . . 17
5.6 Invalid Size Parameter Passed when Retrieving the Program Application Path . 18
5.7 Leak of Service Manager Handles in OpenVPN GUI . . . . . . . . . . . . . . . . 18
6 Cryptographic Mechanisms Assessment 20
6.1 Cryptographic Back Ends . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
6.2 Supported Algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
6.2.1 Encryption Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
6.2.2 Hash Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
6.2.3 Cipher Suites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
6.3 Random Number Generators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
6.3.1 Sensitive Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
6.3.2 Internal Generator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
6.4 Static Key Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
6.5 Key Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
6.5.1 Key Generation Method 1 . . . . . . . . . . . . . . . . . . . . . . . . . . 24
6.5.2 Key Generation Method 2 . . . . . . . . . . . . . . . . . . . . . . . . . . 24
6.5.3 Key Renegotiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
6.6 Control Channel Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
6.7 Control Channel Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
6.8 Authenticated Encryption with Associated Data . . . . . . . . . . . . . . . . . . 28
6.9 Support for Old Versions of OpenSSL . . . . . . . . . . . . . . . . . . . . . . . . 29
6.10 Minor Bug in the mbed TLS Back End . . . . . . . . . . . . . . . . . . . . . . . 30
7 Recommendations 32
7.1 Summary of Identified Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
7.2 Recommendations for Developers . . . . . . . . . . . . . . . . . . . . . . . . . . 32
7.2.1 SSL Library Sandboxing . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
7.2.2 Code Refactoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
7.2.3 Unit Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
7.2.4 Remove Unsafe Options . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
7.3 Recommendations for Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
7.3.1 Prefer SSL/TLS Mode Over Static Key Mode . . . . . . . . . . . . . . . 33
7.3.2 Control Channel Protection . . . . . . . . . . . . . . . . . . . . . . . . . 33
7.3.3 Scripts and Plugins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
7.3.4 Public Key Pinning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
8 Conclusion 35
9 Annex 36
9.1 Proof of Concept Code for the Pre-Authentication DoS Vulnerability . . . . . . 36
Bibliography 39
Ref.: 17-03-284-REP Quarkslab SAS 2
1. Project Information
Document Change Log
Version Date Change Authors
0.1 13/03/2017 Creation Jean-Baptiste Bédrune
0.2 07/04/2017 First draft sent to Jean-Baptiste Bédrune
OpenVPN Jordan Bouyat
Gabriel Campana
0.3 12/04/2017 Added denial of service Jean-Baptiste Bédrune
with GCM Jordan Bouyat
Gabriel Campana
1.0 13/04/2017 Final version sent to Jean-Baptiste Bédrune
OpenVPN Jordan Bouyat
Gabriel Campana
1.1 25/04/2017 Remarks from OpenVPN Jean-Baptiste Bédrune
taken into account Jordan Bouyat
Gabriel Campana
1.2 10/05/2017 New remarks from OpenVPN Jean-Baptiste Bédrune
taken into account Jordan Bouyat
Gabriel Campana
Quarkslab
Quarkslab SAS, 13 rue Saint Ambroise, 75011 Paris, France
Contact Role Contact information
Frédéric Raynal CEO and Founder fraynal@quarkslab.com
Jean-Baptiste Bédrune R&D Engineer jbbedrune@quarkslab.com
Jordan Bouyat R&D Engineer jbouyat@quarkslab.com
Gabriel Campana R&D Engineer gcampana@quarkslab.com
Open Source Technology Improvement Fund
Contact Role Contact information
Derek Zimmer President and Founder derek@ostif.org
OpenVPN Technologies
Contact Role Contact information
Security mailing list - security@openvpn.net
Ref.: 17-03-284-REP Quarkslab SAS 1
2. Executive Summary
This report describes the results of the security assessment of OpenVPN 2.4.0 made by Quark-
slab between 15 February 2017 and 7 April 2017, and funded by OSTIF. Three Quarkslab
engineers worked on this audit for a total of 50 man days of study.
Scope of the audit
• Audit included OpenVPN 2.4.0 for Windows and Linux, OpenVPN GUI and the TAP
driver for Windows.
• OpenVPN for Android and OpenVPN Connect were not evaluated.
• Cryptographic back ends were explicitly excluded: only the correctness of their use was
evaluated.
Security concerns
• Apre-authenticationdenialofservicewasfound,allowinganattackertostopanOpenVPN
server. This is a high-severity vulnerability whose difficulty to trigger is rated as low.
• An authenticated client can stop the server using AEAD ciphers (default encryption in
2.4.0)bymakingitsendahugenumberofpacketsandrefusingtohonorTLSnegotiations.
It is rated as a medium risk as the client has to be authenticated, and its exploitation is
rated medium due to the large number of packets needed to trigger the problem.
• Some sensitive data are not erased from memory after being used. This is a low-severity
vulnerability which requires specific conditions to be exploited.
• Default encryption and authentication parameters when connecting to older versions of
OpenVPN servers do not offer enough security.
• Outdated authentication mechanisms can be used. OpenVPN should at least display a
deprecation warning.
• When used in conjunction with mbed TLS, OpenVPN provides key cipher suites that are
less secure than the ones provided by OpenSSL.
• OpenVPN provides insecure configuration options which should be not present on default
builds.
• Minor bugs were also identified. They do not cause any serious security concern.
Security overview
• The project follows secure development best practices.
• Memory corruptions on the OpenVPN code are unlikely. Logic errors or cryptographic
bugs are more likely to occur.
Ref.: 17-03-284-REP Quarkslab SAS 2
• M