OpenVPN - Denial of Service due to Exhaustion of Packet-ID counter
Summary
DLA-944-1: openvpn - security update. Affects openvpn versions < 2.2.1-8+deb7u4. Fixed in 2.2.1-8+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenVPN is an open-source virtual private network (VPN) software that allows secure remote access to private networks. It provides encryption, authentication, and tunneling capabilities to create a secure connection between clients and servers. The vulnerability in OpenVPN allows an authenticated client to exhaust the server's packet-id counter, leading to a denial of service (DoS) condition. This occurs when the client causes the server to send a large number of packets, eventually causing the packet-id counter to roll over and trigger an ASSERT() function, resulting in the server process crashing.
Vulnerability Detail
The vulnerability arises from a flaw in the packet-id counter implementation in OpenVPN. An authenticated client can exploit this flaw by sending a large number of packets to the server, causing the packet-id counter to reach its maximum value and roll over. Once the counter rolls over, the server process encounters an ASSERT() function, which halts the execution of the server. To trigger the ASSERT(), the client needs to send at least 2^32 packets, which is equivalent to approximately 196GB of data. This vulnerability can lead to a complete disruption of the OpenVPN server, rendering it unavailable for legitimate users.
How To Fix
Minimum fixed version
2.2.1-8+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openvpnTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The OpenVPN vulnerability allows an authenticated client to exhaust the server's packet-id counter, resulting in a denial of service condition. To mitigate this vulnerability, users should upgrade their OpenVPN packages to version 2.2.1-8+deb7u4 or later. It is crucial to restart the OpenVPN service after the upgrade. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openvpn →
FAQ
The vulnerability allows an authenticated client to cause a denial of service (DoS) condition on the OpenVPN server. By exploiting the flaw in the packet-id counter implementation, the client can exhaust the counter, leading to the server process crashing and becoming unresponsive.
This vulnerability affects OpenVPN installations running on Debian 7 Wheezy. Specifically, OpenVPN versions prior to 2.2.1-8+deb7u4 are vulnerable to the packet-id counter exhaustion issue.
Users should upgrade their OpenVPN packages to version 2.2.1-8+deb7u4 or later. This can be done by obtaining the updated package from the official Debian repositories or using the package management system of their Debian 7 Wheezy systems. After the upgrade, it is crucial to restart the OpenVPN service.
Yes, the vulnerability can only be exploited by an authenticated client. Unauthorized users without valid credentials cannot trigger the packet-id counter exhaustion issue.
No, there are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for openvpn.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
