OpenVPN - Out-of-Bounds Memory Read Vulnerabilities
Summary
DLA-999-1: openvpn - security update. Affects openvpn versions < 2.2.1-8+deb7u5. Fixed in 2.2.1-8+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenVPN is a popular virtual private network (VPN) daemon that allows users to securely connect to private networks over the internet. It provides encryption and authentication to ensure the confidentiality and integrity of data transmitted between clients and servers. OpenVPN is widely used for remote access and site-to-site connections.
Vulnerability Detail
Multiple out-of-bounds memory read vulnerabilities have been discovered in OpenVPN. These vulnerabilities can be exploited by a man-in-the-middle attacker when clients use a HTTP proxy with NTLM authentication. The attacker can cause the client to crash or disclose up to 96 bytes of stack memory, potentially exposing sensitive information such as the proxy password.
How To Fix
Minimum fixed version
2.2.1-8+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openvpnTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the patched version of OpenVPN.
Conclusion
Multiple out-of-bounds memory read vulnerabilities have been discovered in OpenVPN. It is crucial to upgrade to the patched version to mitigate the risk of a man-in-the-middle attacker crashing the client or disclosing sensitive information. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for openvpn →
FAQ
OpenVPN is a virtual private network (VPN) daemon that provides secure connections over the internet.
These vulnerabilities can allow a man-in-the-middle attacker to crash the client or disclose sensitive information from stack memory.
You can fix this vulnerability by upgrading your OpenVPN packages to version 2.2.1-8+deb7u5 or later.
There is no specific workaround mentioned for this vulnerability. Upgrading to the patched version is the recommended solution.
You can find more information about this vulnerability in the Debian Security Advisory DLA-999-1.
Related vulnerabilities
Recent vulnerabilities recorded for openvpn.
