Attention is currently required from: cron2, d12fk, plaisthos, razvanc. MaxF has uploaded this change for review. ( http://gerrit.openvpn.net/c/openvpn/+/1907?usp=email )
Change subject: openvpnserv: harden CheckConfigPath() a bit more ...................................................................... openvpnserv: harden CheckConfigPath() a bit more If the config_path retrieved from the Registry doesn't end with a path sepatator, the prefix check could be satisfied by a sibling directory that starts with the same substring, e.g. "config" vs. "configx". While code in common.c ensures this, that code could disappear in the future leaving the check vulnerable. Instead spend the few CPU cycles to be absolutely sure, we're doing the right thing here. Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2. Contributing Researcher: Vivek Parikh. Reported-by: Vivek Parikh <[email protected]> Tested-by: Vivek Parikh <[email protected]> CVE: 2026-78043 Change-Id: Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182 Signed-off-by: Heiko Hund <[email protected]> Acked-by: Razvan Cojocaru <[email protected]> Acked-by: Arne Schwabe <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1886 Message-Id: <[email protected]> URL: https://www.mail-archive.com/[email protected]/msg38854.html Signed-off-by: Gert Doering <[email protected]> (cherry picked from commit 588af513aac1d2d774fd3fde1716384e3501a5a1) --- M src/openvpnserv/validate.c 1 file changed, 5 insertions(+), 0 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/07/1907/1 diff --git a/src/openvpnserv/validate.c b/src/openvpnserv/validate.c index a59f9b1..bd89205 100644 --- a/src/openvpnserv/validate.c +++ b/src/openvpnserv/validate.c @@ -67,6 +67,11 @@ const WCHAR *config_file = NULL; const WCHAR *config_dir = NULL; + /* config_dir must end with a '\' or the prefix check below could be satisfied by a sibling directory */ + if (config_dir_len == 0 || s->config_dir[config_dir_len - 1] != L'\\') + { + return FALSE; + } /* fname = stdin is special: do not treat it as a relative path */ if (wcscmp(fname, L"stdin") == 0) { -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1907?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: openvpn Gerrit-Branch: release/2.6 Gerrit-Change-Id: Ic983a3bf1ee8d4ef98f3883d5e5ddf234696a182 Gerrit-Change-Number: 1907 Gerrit-PatchSet: 1 Gerrit-Owner: MaxF <[email protected]> Gerrit-Reviewer: cron2 <[email protected]> Gerrit-Reviewer: d12fk <[email protected]> Gerrit-Reviewer: plaisthos <[email protected]> Gerrit-Reviewer: razvanc <[email protected]> Gerrit-CC: openvpn-devel <[email protected]> Gerrit-Attention: plaisthos <[email protected]> Gerrit-Attention: cron2 <[email protected]> Gerrit-Attention: d12fk <[email protected]> Gerrit-Attention: razvanc <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
