Secunia

Some vulnerabilities have been reported in OpenVPN, which can be exploited by malicious people and users to cause a DoS (Denial of Service).

1) An error in flushing the OpenSSL error queue due to a failed client certificate authentication can be exploited to cause another unrelated client to be disconnected.

Successful exploitation requires OpenVPN to run with "verb 0" and without "tls-auth".

2) An error in flushing the OpenSSL error queue when the server fails to decrypt a received packet can be exploited by an authenticated client to disconnect another client via a malformed packet

3) An authenticated client configured in "dev tap" ethernet bridging mode can flood the server with many packets, each with a different spoofed MAC address, and cause the server to deplete system memory.

4) Two or more clients connecting to the server at the same time using the same client certificate can cause a race condition that will crash the server.

Successful exploitation requires that the "duplicate-cn" option is not enabled on the server.

Solution
Update to version 2.0.1.
Further details available in Customer Area

Provided and/or discovered by
Reported by vendor.

Original Advisory
http://openvpn.net/changelog.html

Deep Links
Links available in Customer Area