SoftEther VPN Memory Leak Vulnerability Leading to Denial-of-Service

A memory leak vulnerability has been identified in SoftEther VPN version 5.02.5187. This vulnerability allows an attacker to cause a denial-of-service condition by exploiting the UnixMemoryAlloc function. The issue arises because the function allocates 576 bytes of memory without a corresponding deallocation, leading to a direct memory leak.

Impact

Exploitation of this vulnerability causes a memory leak, where allocated memory is not properly released, potentially leading to increased memory usage and a denial-of-service condition.

Reproduction

To reproduce this vulnerability, use the vpncmd binary file and provide 136 bytes of input to bypass the main menu and access the VPN Tools menu. After entering 'quit', the program will leak 576 bytes of memory.