CVE-2020-12823: 
Cisco AnyConnect Secure Client vulnerability analysis and mitigation

OpenConnect 8.09 has a buffer overflow vulnerability in the get_cert_name function within gnutls.c. The vulnerability was discovered in May 2020 and affects multiple Linux distributions including Debian, Fedora, and OpenSUSE. The issue occurs when processing certificate data, specifically when handling certificate names that exceed the allocated buffer size (NVD, Debian LTS).

The vulnerability stems from a buffer overflow condition in the get_cert_name function within gnutls.c. When processing certificate data, the function fails to properly handle cases where the gnutls_x509_crt_get_dn_by_oid function updates the buffer size parameter if the buffer is too small. The test suite for ocserv calls openconnect with a certificate that has a name that is 84 bytes in length, while the buffer passed to get_cert_name is only 80 bytes. This leads to a buffer overflow condition when writing the null terminator (GitLab MR).

The buffer overflow vulnerability can cause a denial of service through application crashes. Additionally, there is potential for unspecified other impacts, though these are not detailed in the available sources (NVD, Gentoo).

The vulnerability can be triggered via crafted certificate data sent to the get_cert_name function in gnutls.c. The CVSS v3.1 base score is 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating the vulnerability is network-accessible and requires no special privileges or user interaction to exploit (NVD).

The vulnerability was fixed in OpenConnect version 8.10. Various Linux distributions have released security updates: Fedora 30-32 updated to version 8.10-1, Debian 8 'Jessie' updated to version 6.00-2+deb8u2, and Gentoo released version 8.09-r1. Users are advised to upgrade to the patched versions (Fedora, Debian LTS, Gentoo).