Softethervpn: Security audit in progress -- soliciting comments on its scope

[guidovranken]

Dear all,

I have been commissioned to subject Softether VPN to a fuzzing-based security audit, which has lead to the discovery of a number security vulnerabilities, reported to, and acknowledged by the SoftEther VPN team.

My fuzzer repository currently consists of the following items:

• buffers - fuzzes about 10 buffer-related functions (ReadBuf, AdjustBufSize, etc)
• packet parsers - fuzzes the packet parsers for IPv4, DHCP, RADIUS, SSTP, OpenVPN, PPP, IKE, DNS
• IPC - fuzzes NewIPC() (and all the function that are indirectly reached)
• L2TP - fuzzes IPsecProcPacket() + L2TPProcesInterrupts()
• OpenVPN - fuzzes OvsPerformTcpServer()
• RADIUS - fuzzes RadiusLogin()
• RADIUS-EAP - fuzzes EapClientSendMsChapv2AuthClientResponse() and similar functions
• Syslog - fuzzes SendSysLog
• Misc - fuzzes ParseUrl() IPToUniStr() IPToUniStr32() IPToStr() StrToBin() BinToStr() BinToStrEx() CopyBinToStr() IsNum() NormalizeCrlf() ParseToken() StartWith() EndWith() ToInt64() ToStr64() IsEmptyString() MacToStr()
• SSL - several functions related to X509 certificates, RSA, bignum conversion
• ICMP - VLanInsertTag() AdjustTcpMssL2() BuildICMPv6() BuildICMPv6NeighborSoliciation() BuildIPv6() IcmpEchoSend() IcmpParseResult() IsDhcpPacketForSpecificMac() VLanRemoveTag()
• PPP - fuzzes PPPThread()
• Encrypt - EasyEncrypt(), EasyDecrypt()

Some protocols and mechanisms, like IKE, have been intentionally (mostly) kept out of the fuzzers' scope, as they are not relevant for my client. However, I am soliciting references to portions of code that are critical to SoftEther VPN's (overall) operation that I have unintentionally left out. Together with my client I will consider building fuzzers for these parts. Upon finding any security-impacting issue, it will be reported immediately to the SoftEther VPN security address, as I have done with all previous vulnerabilities.

Thank you very much

Guido

[dnobori]

As Guido posted, Guido has conducted the security analysis on the SoftEther VPN code tree. According to him, he did this analysis as a job asked by a particular "client". (I know the client's name, but I do not write it here because I am not sure whether it is allowed to be disclosed.)

Guido found and gave me reports of 8 vulnerabilities (currently) found in the SoftEther VPN code tree. Guido also made patches to solve these problems. The last report from Guido is received in a private email on November 9.

The summary of currently 8 vulnerabilities are:

• 4 missing memory boundaries checks. There is no risk of arbitrary code execution or intrusion on these bugs in my analysis. However, these problems may lead to crash the running server process. So these bugs must be fixed.
• 4 memory leaks. While the amount of leakage is very small per time, these bugs can finally cause process crash. So these bugs must be fixed.

Currently I am preparing the patch and also analyzing the impact of these problems carefully. While my analysis of the present time concludes these 8 bugs do not admit any arbitrary code execution or intrusion but only DoS attacks, I need to check it more deeply.

The patch release process:
Because still there are a lot of users of the SoftEtherVPN_Stable branch, I will apply the patch to the SoftEtherVPN_Stable branch firstly, and at the same time I will submit the pull request for these patch from the SoftEtherVPN_Stable branch to this SoftEtherVPN branch.

[paulmenzel]

As the audit is over, this issue can be closed.