SoftEther VPN Buffer Overflow Vulnerability in Certificate Creation Functions

A buffer overflow vulnerability has been identified in SoftEther VPN version 5.02.5187. The issue arises in the Command.c file within the PtMakeCert and PtMakeCert2048 functions. These functions, part of the VPN Tools menu, handle certificate creation but improperly manage input for the expiration date, allowing for overflow at 137 bytes.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing a crash by overwriting the return address on the stack.

Reproduction

To reproduce this vulnerability, use the vpncmd binary to access the VPN Tools menu. Once in the menu, execute the MakeCert or MakeCert2048 commands. When prompted for the expiration date of the certificate (in days), input a value longer than 137 bytes to trigger the buffer overflow.