Man-in-the-Middle (MitM) attack in OpenConnect VPN Client - CVE-2020-12105

Vulnerability identifier: #VU28215

CSH Severity: Medium

CVSS v4: 6.1 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12105

CWE-ID: CWE-300

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a Man-in-the-Middle attack.

The vulnerability exists due to OpenConnect mishandles negative return values from X509_check_ function calls. A remote attacker can perform a Man-in-the-Middle (MitM) attack and gain access to data, transferred via VPN connection.

OpenConnect VPN Client
Gentoo Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Micro
Basesystem Module
SUSE Package Hub 15
Opensuse
openSUSE Leap
stoken-debuginfo
stoken
libstoken1-debuginfo
stoken-gui-debuginfo
stoken-devel
stoken-gui
libstoken1
stoken-debugsource
oath-toolkit
libpskc0-debuginfo
oath-toolkit-xml
libpskc0
liboath-devel
liboath0-debuginfo
libpskc-devel
liboath0
oath-toolkit-debuginfo
pam_oath-debuginfo
pam_oath
oath-toolkit-debugsource
openconnect-doc
openconnect-lang
openconnect-bash-completion
libopenconnect5-debuginfo
openconnect-devel
libopenconnect5
openconnect-debugsource
openconnect
openconnect-debuginfo

Install updates from vendor's website.

OpenConnect VPN Client - update to 8.09
stoken-debuginfo - update to 0.81-150400.13.2.1
stoken - update to 0.81-150400.13.2.1
libstoken1-debuginfo - update to 0.81-150400.13.2.1
stoken-gui-debuginfo - update to 0.81-150400.13.2.1
stoken-devel - update to 0.81-150400.13.2.1
stoken-gui - update to 0.81-150400.13.2.1
libstoken1 - update to 0.81-150400.13.2.1
stoken-debugsource - update to 0.81-150400.13.2.1
oath-toolkit - update to 2.6.2-150000.3.5.1
libpskc0-debuginfo - update to 2.6.2-150000.3.5.1
oath-toolkit-xml - update to 2.6.2-150000.3.5.1
libpskc0 - update to 2.6.2-150000.3.5.1
liboath-devel - update to 2.6.2-150000.3.5.1
liboath0-debuginfo - update to 2.6.2-150000.3.5.1
libpskc-devel - update to 2.6.2-150000.3.5.1
liboath0 - update to 2.6.2-150000.3.5.1
oath-toolkit-debuginfo - update to 2.6.2-150000.3.5.1
pam_oath-debuginfo - update to 2.6.2-150000.3.5.1
pam_oath - update to 2.6.2-150000.3.5.1
oath-toolkit-debugsource - update to 2.6.2-150000.3.5.1
openconnect-doc - update to 9.12-150400.15.3.1
openconnect-lang - update to 9.12-150400.15.3.1
openconnect-bash-completion - update to 9.12-150400.15.3.1
libopenconnect5-debuginfo - update to 9.12-150400.15.3.1
openconnect-devel - update to 9.12-150400.15.3.1
libopenconnect5 - update to 9.12-150400.15.3.1
openconnect-debugsource - update to 9.12-150400.15.3.1
openconnect - update to 9.12-150400.15.3.1
openconnect-debuginfo - update to 9.12-150400.15.3.1

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00039.html
• https://gitlab.com/openconnect/openconnect/-/merge_requests/96

• MitM attack in OpenConnect VPN client
• OpenSUSE Linux update for openconnect
• Gentoo update for OpenConnect
• SUSE update for openconnect