Denial of Service Vulnerability in OpenVPN - CVE-2017-7478
Summary
ALPINE-CVE-2017-7478: OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Affects openvpn versions < 2.3.15-r0. Fixed in 2.3.15-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenVPN is a widely used open-source software that enables secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It is known for its flexibility and strong security features, making it a popular choice for VPN solutions. However, certain versions of OpenVPN are vulnerable to a Denial of Service (DoS) attack, which can severely disrupt service availability.
Vulnerability Detail
The vulnerability identified as CVE-2017-7478 affects OpenVPN versions 2.3.12 and newer. It allows an unauthenticated Denial of Service attack on the server through the receipt of a large control packet. This can lead to service disruption, as the server may become unresponsive to legitimate requests. The issue arises from improper handling of large packets, which can overwhelm the server's resources.
How To Fix
Minimum fixed version
2.3.15-r0
This is the first release that contains the fix.
sudo apk add --upgrade openvpnTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can implement rate limiting on incoming packets to mitigate the impact of potential DoS attacks. This can be done using firewall rules to restrict the size and rate of packets that the server processes.
Conclusion
CVE-2017-7478 represents a significant vulnerability in OpenVPN that can lead to Denial of Service attacks. It is crucial for users to update to the patched versions to maintain service availability and security. Implementing workarounds can provide temporary relief until updates can be applied.
See every vulnerability recorded for openvpn →
FAQ
CVE-2017-7478 is a vulnerability in OpenVPN that allows unauthenticated Denial of Service attacks via large control packets.
OpenVPN versions 2.3.12 and newer are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of CVE-2017-7478 is 7.5, indicating a high severity level.
If immediate updates are not possible, consider implementing rate limiting on incoming packets as a temporary workaround to mitigate potential DoS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for openvpn.
