search

OpenVPN / openvpn-gui

OpenVPN GUI is a graphical frontend for OpenVPN running on Windows 7 / 8 / 10. It creates an icon in the notification area from which you can control OpenVPN to start/stop your VPN tunnels, view the log and do other useful things.
Other
1.38k stars 397 forks source link

Validate the service pipe to avoid connecting to a bogus pipe #691

Closed selvanair closed 2 weeks ago

selvanair commented 2 weeks ago

If an attacker with SeImeprsonatePrivilege manages to create a namedpipe server with a name matching that used by the "Interactive Service", the GUI connecting to it could allow the attacker to impersonate the GUI user.

Fix by validating the service pipe by comparing the pid of the pipe server with that of the "Interactive Service".

Note: GetNamedPipeServerProcessId() returns the pid of the process that created the first instance of the pipe. So, this patch only guards against a rogue pipe instance created before the service has started. This has to work in combination with a patch for the service that disallows creation of additional pipe instances when the service is running.

CVE: CVE-2024-4877 Reported by: Zeze with TeamT5 zeze7w@gmail.com

Acked-by: Lev Stipakov lstipakov@gmail.com

selvanair commented 2 weeks ago

changes since last review:

cron2 commented 2 weeks ago

Looks good to me, and matches the patch proposed and ACKed by @lstipakov on the security@ list.