OpenVPN - Authenticated Client Crash Vulnerability
Summary
DSA-3084-1: openvpn - security update. Affects openvpn versions < 2.2.1-8+deb7u3. Fixed in 2.2.1-8+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenVPN is an open-source virtual private network (VPN) software that allows secure remote access to private networks. It provides encryption and authentication to ensure the confidentiality and integrity of data transmitted over the network. OpenVPN is widely used for creating secure connections between clients and servers.
Vulnerability Detail
An authenticated client can exploit a vulnerability in OpenVPN by sending a control packet with a payload of less than four bytes. This can cause the OpenVPN server to crash. The vulnerability was discovered by Dragana Damjanovic. If successfully exploited, this vulnerability could lead to denial of service (DoS) attacks against OpenVPN servers.
How To Fix
Minimum fixed version
2.2.1-8+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade openvpnTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading the OpenVPN package.
Conclusion
The OpenVPN - Authenticated Client Crash Vulnerability allows an authenticated client to crash an OpenVPN server, potentially leading to denial of service (DoS) attacks. It is crucial to upgrade the OpenVPN package to the recommended versions to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for openvpn →
FAQ
OpenVPN is an open-source virtual private network (VPN) software that provides secure remote access to private networks.
An authenticated client can crash an OpenVPN server, leading to denial of service (DoS) attacks.
The vulnerability was discovered by Dragana Damjanovic.
Upgrade the OpenVPN package to the recommended versions: 2.2.1-8+deb7u3 for Debian 7 (wheezy) and 2.3.4-5 for the unstable distribution (sid).
There is no known workaround. It is recommended to apply the fix by upgrading the OpenVPN package.
Related vulnerabilities
Recent vulnerabilities recorded for openvpn.
