Amazon Linux AMI : openvpn Chosen Ciphertext Vulnerability (ALAS-2013-201)

This script is Copyright (C) 2013 Tenable Network Security, Inc.

Synopsis :

The remote Amazon Linux AMI host is missing a security update.

Description :

OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen
ciphertext injection due to a non-constant-time HMAC comparison
function. Plaintext recovery may be possible using a padding oracle
attack on the CBC mode cipher implementation of the crypto library,
optimistically at a rate of about one character per 3 hours. PolarSSL
seems vulnerable to such an attack
the vulnerability of OpenSSL has
not been verified or tested.

OpenVPN servers are typically configured to silently drop packets with
the wrong HMAC. For this reason measuring the processing time of the
packets is not trivial without a MITM position. In practice, the
attack likely needs some target-specific information to be effective.

The severity of this vulnerability can be considered low. Only if
OpenVPN is configured to use a null-cipher, arbitrary plain-text can
be injected which can completely open up this attack vector.

See also :

Solution :

Run 'yum update openvpn' to update your system.

Risk factor :

Low / CVSS Base Score : 2.6

Family: Amazon Linux Local Security Checks

Nessus Plugin ID: 69759 ()

Bugtraq ID:

CVE ID: CVE-2013-2061