Missing message authentication in Tinc VPN
Summary
CVE-2018-16758: Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN packets. Affects tinc versions < 1.0.35-r0. Fixed in 1.0.35-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Tinc VPN is an open-source Virtual Private Network (VPN) software that provides secure communication between nodes over the internet. It allows users to create a private network that can be used to connect remote locations or devices securely. Tinc VPN uses encryption to protect the confidentiality and integrity of VPN packets.
Vulnerability Detail
The vulnerability identified as CVE-2018-16758 in Tinc VPN version 1.0.34 and earlier is due to missing message authentication in the meta-protocol. This flaw allows a man-in-the-middle attack to disable the encryption of VPN packets. An attacker can intercept and modify the VPN packets, potentially exposing sensitive information or tampering with the communication.
How To Fix
Minimum fixed version
1.0.35-r0
This is the first release that contains the fix.
sudo apk add --upgrade tincTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version as soon as possible to mitigate the risk of exploitation.
Conclusion
The missing message authentication vulnerability in Tinc VPN version 1.0.34 and earlier can be exploited by a man-in-the-middle attacker to disable encryption of VPN packets. To mitigate this risk, it is essential to upgrade Tinc VPN to version 1.0.35-r0 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tinc →
FAQ
Tinc VPN is an open-source software that enables secure communication between nodes over the internet, creating a private network.
This vulnerability allows a man-in-the-middle attack to disable the encryption of VPN packets, potentially exposing sensitive information or tampering with the communication.
To fix this vulnerability, upgrade Tinc VPN to version 1.0.35-r0 or later.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version.
For more information, refer to the CVE-2018-16758 JSON report at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16758.json
Related vulnerabilities
Recent vulnerabilities recorded for tinc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
