CVE-2020-7041

Vulnerability

The openfortivpn VPN client version 1.11.0, when built with OpenSSL 1.0.2 or later, contains a certificate validation flaw in tunnel.c. The function X509_check_host returns a negative error code on failure, but the code incorrectly interprets any non-zero return value as success. Consequently, a server certificate whose hostname mismatch or other validation failure results in a negative return code is accepted as valid. This affects all installations of openfortivpn 1.11.0 using OpenSSL 1.0.2+ [1][2].

Exploitation

An attacker in a network position to intercept or redirect VPN traffic (e.g., on the same network segment, or via DNS spoofing) can present a crafted TLS certificate to the vulnerable client. The client's flawed validation logic will treat the negative return code from X509_check_host as a pass, allowing the connection to proceed. No additional authentication or user interaction beyond initiating a VPN connection is required.

Impact

Successful exploitation enables a man-in-the-middle (MITM) attacker to decrypt, read, and modify the VPN tunnel's traffic. The attacker can also impersonate the legitimate VPN gateway, gaining access to credentials and other sensitive data transmitted during the session. The impact is a complete compromise of confidentiality, integrity, and availability of the VPN connection.

Mitigation

The vulnerability is fixed in openfortivpn version 1.12.0, which corrects the return value handling of X509_check_host [2]. Users should upgrade to version 1.12.0 or later. No workaround is available for version 1.11.0. Fedora package announcements reference updates addressing this issue; users of affected distributions should apply the provided updates [3][4].