Buffer overflow in OpenConnect VPN Client - CVE-2020-12823

Vulnerability identifier: #VU28192

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12823

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary within the get_cert_name() function in gnutls.c. A remote attacker can trick the victim to connect to a malicious VPN server, trigger buffer overflow and crash the client or execute arbitrary code on the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

OpenConnect VPN Client
Gentoo Linux
Arch Linux
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Micro
Basesystem Module
SUSE Package Hub 15
Opensuse
openSUSE Leap
Fedora
stoken-debuginfo
stoken-debugsource
libstoken1
stoken-gui
stoken-devel
stoken-gui-debuginfo
libstoken1-debuginfo
stoken
liboath0
oath-toolkit-debuginfo
pam_oath-debuginfo
pam_oath
oath-toolkit-debugsource
libpskc-devel
liboath0-debuginfo
liboath-devel
libpskc0
oath-toolkit
libpskc0-debuginfo
oath-toolkit-xml
openconnect
openconnect-doc
openconnect-lang
openconnect-bash-completion
libopenconnect5-debuginfo
openconnect-devel
libopenconnect5
openconnect-debugsource
openconnect-debuginfo

Install update from vendor's website.

OpenConnect VPN Client - update to 8.10
stoken-debuginfo - update to 0.81-150400.13.2.1
stoken-debugsource - update to 0.81-150400.13.2.1
libstoken1 - update to 0.81-150400.13.2.1
stoken-gui - update to 0.81-150400.13.2.1
stoken-devel - update to 0.81-150400.13.2.1
stoken-gui-debuginfo - update to 0.81-150400.13.2.1
libstoken1-debuginfo - update to 0.81-150400.13.2.1
stoken - update to 0.81-150400.13.2.1
liboath0 - update to 2.6.2-150000.3.5.1
oath-toolkit-debuginfo - update to 2.6.2-150000.3.5.1
pam_oath-debuginfo - update to 2.6.2-150000.3.5.1
pam_oath - update to 2.6.2-150000.3.5.1
oath-toolkit-debugsource - update to 2.6.2-150000.3.5.1
libpskc-devel - update to 2.6.2-150000.3.5.1
liboath0-debuginfo - update to 2.6.2-150000.3.5.1
liboath-devel - update to 2.6.2-150000.3.5.1
libpskc0 - update to 2.6.2-150000.3.5.1
oath-toolkit - update to 2.6.2-150000.3.5.1
libpskc0-debuginfo - update to 2.6.2-150000.3.5.1
oath-toolkit-xml - update to 2.6.2-150000.3.5.1
openconnect - addressed in versions 8.10-1.fc30, 8.10-1.fc31, 8.10-1.fc32
openconnect-doc - update to 9.12-150400.15.3.1
openconnect-lang - update to 9.12-150400.15.3.1
openconnect-bash-completion - update to 9.12-150400.15.3.1
libopenconnect5-debuginfo - update to 9.12-150400.15.3.1
openconnect-devel - update to 9.12-150400.15.3.1
libopenconnect5 - update to 9.12-150400.15.3.1
openconnect-debugsource - update to 9.12-150400.15.3.1
openconnect - update to 9.12-150400.15.3.1
openconnect-debuginfo - update to 9.12-150400.15.3.1

• https://bugs.gentoo.org/721570
• https://gitlab.com/openconnect/openconnect/-/merge_requests/108
• https://lists.debian.org/debian-lts-announce/2020/05/msg00015.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYSXLXAPXD2T73T6JMHI5G2WP7KHAGMN/

• Remote code execution in OpenConnect VPN client
• Arch Linux update for openconnect
• Gentoo update for OpenConnect
• OpenSUSE Linux update for openconnect
• OpenSUSE Linux update for openconnect
• SUSE update for openconnect
• Fedora 30 update for openconnect
• Fedora 32 update for openconnect
• Fedora 31 update for openconnect