CVE-2020-7041 (published 2020-02-27T18:15Z)

An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host negative error code is interpreted as a successful return value.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-295
cwe_name: Improper Certificate Validation
description: The product does not validate, or incorrectly validates, a certificate.
extended_description: When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
         

Fix information:
repo_url: https://github.com/adrienverge/openfortivpn
commit_details: repo_url: https://github.com/adrienverge/openfortivpn
author: Martin Hecht
author_date: 2020-02-24 15:30:34+01:00
msg: openfortivpn version 1.12.0
repository: repo_url: https://github.com/adrienverge/openfortivpn
repo_name: adrienverge/openfortivpn
description: Client for PPP+TLS VPN tunnel services
repo_language: Perl
owner: adrienverge
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -14,6 +14,18 @@ Releases
 This high level changelog is usually updated when a release is tagged.
 On the master branch there may be changes that are not (yet) described here.
 
+### 1.12.0
+
+* [-] fix CVE-2020-7043: TLS Certificate CommonName NULL Byte Vulnerability
+* [-] fix CVE-2020-7042: use of uninitialized memory in X509_check_host
+* [-] fix CVE-2020-7041: incorrect use of X509_check_host (regarding return value).
+* [-] always hide cleartest password in -vv output
+* [+] add a clear warning about sensitive information in the debug output
+* [+] add a hint in debug output when password is read from config file
+* [-] fix segfault when connecting with empty password
+* [+] use resolvconf if available to update resolv.conf file
+* [~] replace semicolon by space in dns-suffix string
+
 ### 1.11.0
 
 * [+] allow to connect with empty password (and with smartcard instead of username)

programming_language: Markdown
filename: configure.ac
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.63])
-AC_INIT([openfortivpn], [1.11.0])
+AC_INIT([openfortivpn], [1.12.0])
 AC_CONFIG_SRCDIR([src/main.c])
 AM_INIT_AUTOMAKE([foreign subdir-objects])
 

programming_language: Shell
repo_url: https://github.com/adrienverge/openfortivpn
commit_details: repo_url: https://github.com/adrienverge/openfortivpn
author: Martin Hecht
author_date: 2020-02-21 20:53:04+01:00
msg: correctly check return value of X509_check_host

CVE-2020-7041 incorrect use of X509_check_host (regarding return value)
is fixed with this commit.

The flaw came in with #242 and prevented proper host name verification
when openssl >= 1.0.2 was in use since openfortivpn 1.7.0.
repository: repo_url: https://github.com/adrienverge/openfortivpn
repo_name: adrienverge/openfortivpn
description: Client for PPP+TLS VPN tunnel services
repo_language: Perl
owner: adrienverge
file_changes: filename: tunnel.c
change_type: ModificationType.MODIFY
diff: @@ -666,7 +666,8 @@ static int ssl_verify_cert(struct tunnel *tunnel)
 
 #ifdef HAVE_X509_CHECK_HOST
 	// Use OpenSSL native host validation if v >= 1.0.2.
-	if (X509_check_host(cert, common_name, FIELD_SIZE, 0, NULL))
+	// correctly check return value of X509_check_host
+	if (X509_check_host(cert, common_name, FIELD_SIZE, 0, NULL) == 1)
 		cert_valid = 1;
 #else
 	// Use explicit Common Name check if native validation not available.

programming_language: C