OpenVPN: Multiple vulnerabilities — GLSA 200511-07

The OpenVPN client is potentially vulnerable to the execution of arbitrary code and the OpenVPN server is vulnerable to a Denial of Service issue.

Affected packages

Background

OpenVPN is a multi-platform, full-featured SSL VPN solution.

Description

The OpenVPN client contains a format string bug in the handling of the foreign_option in options.c. Furthermore, when the OpenVPN server runs in TCP mode, it may dereference a NULL pointer under specific error conditions.

Impact

A remote attacker could setup a malicious OpenVPN server and trick the user into connecting to it, potentially executing arbitrary code on the client's computer. A remote attacker could also exploit the NULL dereference issue by sending specific packets to an OpenVPN server running in TCP mode, resulting in a Denial of Service condition.

Workaround

Do not use "pull" or "client" options in the OpenVPN client configuration file, and use UDP mode for the OpenVPN server.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-misc/openvpn-2.0.4"

References

• CVE-2005-3393
• CVE-2005-3409
• OpenVPN changelog

Release date
November 06, 2005

Latest revision
November 06, 2005: 01

Severity
normal

Exploitable
remote

Bugzilla entries

• 111116