Re: Blackhat 4 zero days ?

Gert Doering <[email protected]> Sat, 4 May 2024 00:13:34 +0200
Newsgroups	gmane.network.openvpn.user
Message-ID	<[email protected]>
Hi,

On Fri, May 03, 2024 at 04:25:29PM -0400, mike tancsa wrote:
> Is there any more information about this somewhere ?
> 
> https://www.blackhat.com/us-24/briefings/schedule/#ovpnx--zero-days-leading-to-rce-lpe-and-kce-via-byovd-affecting-millions-of-openvpn-endpoints-across-the-globe-38900

See "Changes.rst" :-)

Overview of changes in 2.6.10
=============================
Security fixes
--------------
- CVE-2024-27459: Windows: fix a possible stack overflow in the
  interactive service component which might lead to a local privilege
  escalation.
  Reported-by: Vladimir Tokarev <[email protected]>

- CVE-2024-24974: Windows: disallow access to the interactive service
  pipe from remote computers.
  Reported-by: Vladimir Tokarev <[email protected]>

- CVE-2024-27903: Windows: disallow loading of plugins from untrusted
  installation paths, which could be used to attack openvpn.exe via
  a malicious plugin.  Plugins can now only be loaded from the OpenVPN
  install directory, the Windows system directory, and possibly from
  a directory specified by HKLM\SOFTWARE\OpenVPN\plugin_dir.
  Reported-by: Vladimir Tokarev <[email protected]>


Short summary: if you want to use plugins on Windows, do not put them
into directories writeable for other users - and this is now enforced
by OpenVPN itself.  The attack is somewhat obscure, and needs a chain
of "User A runs a plugin from a directory User B can write to, and
User B puts a malicious plugin there, exploiting a bug in the iservice".

On Windows, if you have other users on the system, just upgrade to 2.6.10
or 2.5.10.

On non-Windows, all the iservice bugs do not exist, and we didn't do
anything about plugin loading from "directories writeable for other 
people" because we think that this is not a realistic scenario.


And, just because it needs to be said, kudos to Vladimir Tokarev for
discovering these, and working closely with us to get the fixes designed,
tested, and released.  So I hope this makes a talk that is fun and 
enlightening!

gert
-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             [email protected]

_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
signature.asc (application/pgp-signature, 630 B)