Cleartext storage of sensitive information in OpenConnect VPN Client - CVE-2018-20319

Vulnerability identifier: #VU28218

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-20319

CWE-ID: CWE-312

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to OpenConnect VPN client stores credentials in an insecure manner in memory. A local user can read credentials from memory in plain text.

OpenConnect VPN Client
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Micro
Basesystem Module
SUSE Package Hub 15
openSUSE Leap
stoken-debuginfo
stoken
libstoken1-debuginfo
stoken-gui-debuginfo
stoken-devel
stoken-gui
libstoken1
stoken-debugsource
oath-toolkit
libpskc0-debuginfo
oath-toolkit-xml
libpskc0
liboath-devel
liboath0-debuginfo
libpskc-devel
liboath0
oath-toolkit-debuginfo
pam_oath-debuginfo
pam_oath
oath-toolkit-debugsource
openconnect-doc
openconnect-lang
openconnect-bash-completion
libopenconnect5-debuginfo
openconnect-devel
libopenconnect5
openconnect-debugsource
openconnect
openconnect-debuginfo

Install updates from vendor's website.

OpenConnect VPN Client - update to 8.00
stoken-debuginfo - update to 0.81-150400.13.2.1
stoken - update to 0.81-150400.13.2.1
libstoken1-debuginfo - update to 0.81-150400.13.2.1
stoken-gui-debuginfo - update to 0.81-150400.13.2.1
stoken-devel - update to 0.81-150400.13.2.1
stoken-gui - update to 0.81-150400.13.2.1
libstoken1 - update to 0.81-150400.13.2.1
stoken-debugsource - update to 0.81-150400.13.2.1
oath-toolkit - update to 2.6.2-150000.3.5.1
libpskc0-debuginfo - update to 2.6.2-150000.3.5.1
oath-toolkit-xml - update to 2.6.2-150000.3.5.1
libpskc0 - update to 2.6.2-150000.3.5.1
liboath-devel - update to 2.6.2-150000.3.5.1
liboath0-debuginfo - update to 2.6.2-150000.3.5.1
libpskc-devel - update to 2.6.2-150000.3.5.1
liboath0 - update to 2.6.2-150000.3.5.1
oath-toolkit-debuginfo - update to 2.6.2-150000.3.5.1
pam_oath-debuginfo - update to 2.6.2-150000.3.5.1
pam_oath - update to 2.6.2-150000.3.5.1
oath-toolkit-debugsource - update to 2.6.2-150000.3.5.1
openconnect-doc - update to 9.12-150400.15.3.1
openconnect-lang - update to 9.12-150400.15.3.1
openconnect-bash-completion - update to 9.12-150400.15.3.1
libopenconnect5-debuginfo - update to 9.12-150400.15.3.1
openconnect-devel - update to 9.12-150400.15.3.1
libopenconnect5 - update to 9.12-150400.15.3.1
openconnect-debugsource - update to 9.12-150400.15.3.1
openconnect - update to 9.12-150400.15.3.1
openconnect-debuginfo - update to 9.12-150400.15.3.1

• https://labs.nettitude.com/blog/why-you-should-always-have-two-factor-authentication-on-your-vpn-cve-2018-20319/
• http://www.infradead.org/openconnect/changelog.html

• Information disclosure in OpenConnect VPN client
• SUSE update for openconnect