|
OpenVPN Multiple DoS Vulnerabilities
|
|
Secunia Advisory:
|
SA16463
|
|
|
Release Date:
|
2005-08-19
|
|
Popularity:
|
8,927 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
DoS
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | OpenVPN 1.x
OpenVPN 2.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2005-2531
CVE-2005-2532
CVE-2005-2533
CVE-2005-2534
|
|
Description:
Some vulnerabilities have been reported in OpenVPN, which can be exploited by malicious people and users to cause a DoS (Denial of Service).
1) An error in flushing the OpenSSL error queue due to a failed client certificate authentication can be exploited to cause another unrelated client to be disconnected.
Successful exploitation requires OpenVPN to run with "verb 0" and without "tls-auth".
2) An error in flushing the OpenSSL error queue when the server fails to decrypt a received packet can be exploited by an authenticated client to disconnect another client via a malformed packet
3) An authenticated client configured in "dev tap" ethernet bridging mode can flood the server with many packets, each with a different spoofed MAC address, and cause the server to deplete system memory.
4) Two or more clients connecting to the server at the same time using the same client certificate can cause a race condition that will crash the server.
Successful exploitation requires that the "duplicate-cn" option is not enabled on the server.
Solution:
Update to version 2.0.1.
http://openvpn.net/download.html
Provided and/or discovered by:
Reported by vendor.
Original Advisory:
http://openvpn.net/changelog.html
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
