CVE-2020-7042 (published 2020-02-27T18:15Z)

An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted).

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-295
cwe_name: Improper Certificate Validation
description: The product does not validate, or incorrectly validates, a certificate.
extended_description: When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
         
cwe_id: CWE-908
cwe_name: Use of Uninitialized Resource
description: The product uses or accesses a resource that has not been initialized.
extended_description: When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
         

Fix information:
repo_url: https://github.com/adrienverge/openfortivpn
commit_details: repo_url: https://github.com/adrienverge/openfortivpn
author: Martin Hecht
author_date: 2020-02-24 15:30:34+01:00
msg: openfortivpn version 1.12.0
repository: repo_url: https://github.com/adrienverge/openfortivpn
repo_name: adrienverge/openfortivpn
description: Client for PPP+TLS VPN tunnel services
repo_language: Perl
owner: adrienverge
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -14,6 +14,18 @@ Releases
 This high level changelog is usually updated when a release is tagged.
 On the master branch there may be changes that are not (yet) described here.
 
+### 1.12.0
+
+* [-] fix CVE-2020-7043: TLS Certificate CommonName NULL Byte Vulnerability
+* [-] fix CVE-2020-7042: use of uninitialized memory in X509_check_host
+* [-] fix CVE-2020-7041: incorrect use of X509_check_host (regarding return value).
+* [-] always hide cleartest password in -vv output
+* [+] add a clear warning about sensitive information in the debug output
+* [+] add a hint in debug output when password is read from config file
+* [-] fix segfault when connecting with empty password
+* [+] use resolvconf if available to update resolv.conf file
+* [~] replace semicolon by space in dns-suffix string
+
 ### 1.11.0
 
 * [+] allow to connect with empty password (and with smartcard instead of username)

programming_language: Markdown
filename: configure.ac
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.63])
-AC_INIT([openfortivpn], [1.11.0])
+AC_INIT([openfortivpn], [1.12.0])
 AC_CONFIG_SRCDIR([src/main.c])
 AM_INIT_AUTOMAKE([foreign subdir-objects])
 

programming_language: Shell
repo_url: https://github.com/adrienverge/openfortivpn
commit_details: repo_url: https://github.com/adrienverge/openfortivpn
author: Martin Hecht
author_date: 2020-02-21 20:58:11+01:00
msg: supply proper input buffer to X509_check_host

CVE-2020-7042 use of uninitialized memory in X509_check_host is fixed with
this commit

the uninitialized buffer common_name was passed as argument to X509_check_host
which prevented proper host name validation when openssl >= 1.0.2 was in use.
This came in with #282 which went into openfortivpn 1.7.1.
Unfortunately, this problem has stayed unnoticed because the return value
was not properly checked either (which is a separate issue, with CVE-2020-7041,
and which has been fixed by the previous commit)
repository: repo_url: https://github.com/adrienverge/openfortivpn
repo_name: adrienverge/openfortivpn
description: Client for PPP+TLS VPN tunnel services
repo_language: Perl
owner: adrienverge
file_changes: filename: tunnel.c
change_type: ModificationType.MODIFY
diff: @@ -652,7 +652,6 @@ static int ssl_verify_cert(struct tunnel *tunnel)
 	char *line;
 	int i;
 	X509_NAME *subj;
-	char common_name[FIELD_SIZE + 1];
 
 	SSL_set_verify(tunnel->ssl_handle, SSL_VERIFY_PEER, NULL);
 
@@ -666,10 +665,13 @@ static int ssl_verify_cert(struct tunnel *tunnel)
 
 #ifdef HAVE_X509_CHECK_HOST
 	// Use OpenSSL native host validation if v >= 1.0.2.
-	// correctly check return value of X509_check_host
-	if (X509_check_host(cert, common_name, FIELD_SIZE, 0, NULL) == 1)
+	// compare against gateway_host and correctly check return value
+	// to fix piror Incorrect use of X509_check_host
+	if (X509_check_host(cert, tunnel->config->gateway_host,
+	                    0, 0, NULL) == 1)
 		cert_valid = 1;
 #else
+	char common_name[FIELD_SIZE + 1];
 	// Use explicit Common Name check if native validation not available.
 	// Note: this will ignore Subject Alternative Name fields.
 	if (subj

programming_language: C