[Fwknop-discuss] fwknop-2.0.3 released

[Michael R. <mb...@ci...>]

Hi all,

fwknop-2.0.3 has been released:

http://www.cipherdyne.org/fwknop/download/

This is an important release that tightens up the code in several areas
based on excellent research performed by Fernando Arnaboldi of IOActive.
I wish to thank Fernando for this work, and also Erik Gomez of IOActive
as well for making this research possible. Fernando's research turned up
potential DoS and/or code execution vulnerabilities in the fwknopd
server for malicious authenticated clients, insecure filesystem
permissions handling, and more. All of these issues have been fixed in
the 2.0.3 release.

Here is the complete ChangeLog:

- [server] Fernando Arnaboldi from IOActive found several DoS/code
  execution vulnerabilities for malicious fwknop clients that manage to
  get past the authentication stage (so a such a client must be in
  possession of a valid access.conf encryption key).  These vulnerabilities
  manifested themselves in the handling of malformed access requests, and
  both the fwknopd server code along with libfko now perform stronger input
  validation of access request data.  These vulnerabilities affect
  pre-2.0.3 fwknop releases.
- [server] Fernando Arnaboldi from IOActive found a condition in which
  the server did not properly validate allow IP addresses from malicious
  authenticated clients.  This has been fixed with stronger allow IP
  validation.
- [client+server] Fernando Arnaboldi from IOActive found that strict
  filesystem permissions for various fwknop files are not verified.  Added
  warnings whenever permissions are not strict enough, and ensured that
  files created by the fwknop client and server are only set to user
  read/write.
- [client] Fernando Arnaboldi from IOActive found a local buffer overflow
  in --last processing with a maliciously constructed ~/.fwknop.run file.
  This has been fixed with proper validation of .fwknop.run arguments.
- [server] Fernando Arnaboldi from IOActive found several conditions in
  which the server did not properly throw out maliciously constructed
  variables in the access.conf file.  This has been fixed along with new
  fuzzing tests in the test suite.
- [test suite] Added a new fuzzing capability to ensure proper server-side
  input validation.  Fuzzing data is constructed with modified fwknop
  client code that is designed to emulate malicious behavior.
- Fixed RPM builds by including the $(DESTDIR) prefix for uninstall-local
  and install-exec-hook stages in Makefile.am.

Thanks,

--Mike