Buffer overflow in OpenConnect VPN Client - CVE-2019-16239

Vulnerability identifier: #VU22305

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-16239

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary in the process_http_response when processing HTTP responses. A remote attacker that controls a malicious HTTP server can trick the victim to visit a malicious website, send an HTTP response with crafted chunk sizes for HTTP chunked encoding, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

OpenConnect VPN Client
Debian Linux
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
Opensuse
Basesystem Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
Fedora
stoken-debuginfo
stoken-debugsource
libstoken1
stoken-gui
stoken-devel
stoken-gui-debuginfo
libstoken1-debuginfo
stoken
pam_oath-debuginfo
pam_oath
oath-toolkit-debugsource
libpskc0
oath-toolkit
libpskc0-debuginfo
oath-toolkit-xml
oath-toolkit-debuginfo
liboath0
libpskc-devel
liboath0-debuginfo
liboath-devel
openconnect (Debian package)
openconnect (Ubuntu package)
libopenconnect5 (Ubuntu package)
openconnect
openconnect-doc
openconnect-lang
openconnect-bash-completion
libopenconnect5-debuginfo
openconnect-devel
libopenconnect5
openconnect-debugsource
openconnect-debuginfo

Install update from vendor's website.

OpenConnect VPN Client - update to 8.05
stoken-debuginfo - update to 0.81-150400.13.2.1
stoken-debugsource - update to 0.81-150400.13.2.1
libstoken1 - update to 0.81-150400.13.2.1
stoken-gui - update to 0.81-150400.13.2.1
stoken-devel - update to 0.81-150400.13.2.1
stoken-gui-debuginfo - update to 0.81-150400.13.2.1
libstoken1-debuginfo - update to 0.81-150400.13.2.1
stoken - update to 0.81-150400.13.2.1
pam_oath-debuginfo - update to 2.6.2-150000.3.5.1
pam_oath - update to 2.6.2-150000.3.5.1
oath-toolkit-debugsource - update to 2.6.2-150000.3.5.1
libpskc0 - update to 2.6.2-150000.3.5.1
oath-toolkit - update to 2.6.2-150000.3.5.1
libpskc0-debuginfo - update to 2.6.2-150000.3.5.1
oath-toolkit-xml - update to 2.6.2-150000.3.5.1
oath-toolkit-debuginfo - update to 2.6.2-150000.3.5.1
liboath0 - update to 2.6.2-150000.3.5.1
libpskc-devel - update to 2.6.2-150000.3.5.1
liboath0-debuginfo - update to 2.6.2-150000.3.5.1
liboath-devel - update to 2.6.2-150000.3.5.1
openconnect (Debian package) - addressed in versions 7.08-1+deb9u1, 8.02-1+deb10u1
openconnect (Ubuntu package) - update to 7.08-3ubuntu0.18.04.2
libopenconnect5 (Ubuntu package) - update to 7.08-3ubuntu0.18.04.2
openconnect - addressed in versions 8.05-1.fc29, 8.05-1.fc30, 8.05-1.fc31
openconnect-doc - update to 9.12-150400.15.3.1
openconnect-lang - update to 9.12-150400.15.3.1
openconnect-bash-completion - update to 9.12-150400.15.3.1
libopenconnect5-debuginfo - update to 9.12-150400.15.3.1
openconnect-devel - update to 9.12-150400.15.3.1
libopenconnect5 - update to 9.12-150400.15.3.1
openconnect-debugsource - update to 9.12-150400.15.3.1
openconnect - update to 9.12-150400.15.3.1
openconnect-debuginfo - update to 9.12-150400.15.3.1

• http://lists.infradead.org/pipermail/openconnect-devel/2019-September/005412.html
• https://t2.fi/schedule/2019/

• Buffer overflow in OpenConnect VPN client
• OpenSUSE Linux update for openconnect
• OpenSUSE Linux update for openconnect
• Debian update for openconnect
• SUSE update for openconnect
• Ubuntu update for openconnect
• Fedora 29 update for openconnect
• Fedora 30 update for openconnect
• Fedora 31 update for openconnect