OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server, which allows remote authenticated attackers to cause a denial of service (client disconnection) via a large number of packets that can not be decrypted.

According to its self-reported version number, the version of OpenVPN installed on the remote Windows host is prior to 2.0.1. It is, therefore, affected by multiple vulnerabilities:
  - A denial of service (DoS) vulnerability exists in OpenVPN due to its OpenSSL error queue not being flushed properly.
    An unauthenticated, remote attacker can exploit this issue, by sending a large number of incorrect connection     requests, to cause the application to stop responding (CVE-2005-2531) & (CVE-2005-2532).

  - OpenVPN is affected by a denial of service (DoS) vulnerability. An authenticated, remote attacker can exploit this     issue, by sending a large of number of packets with spoofed MAC addresses, to cause the application to stop     responding (CVE-2005-2533).

  - A denial of service (DoS) vulnerability exists in OpenVPN when --duplicate-cn is not enabled. An unauthenticated,     remote attacker can exploit this issue, by issuing simultaneous tcp connections from multiple clients that use the     same certificate, to cause the application to stop responding (CVE-2005-2534).

James Yonan reports :

If the client sends a packet which fails to decrypt on the server, the OpenSSL error queue is not properly flushed, which can result in another unrelated client instance on the server seeing the error and responding to it, resulting in disconnection of the unrelated client.

Several security related problems have been discovered in openvpn, a Virtual Private Network daemon. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-2531     Wrong processing of failed certificate authentication     when running with 'verb 0' and without TLS     authentication can lead to a denial of service by     disconnecting the wrong client.

  - CAN-2005-2532

    Wrong handling of packets that can't be decrypted on the     server can lead to the disconnection of unrelated     clients.

  - CAN-2005-2533

    When running in 'dev tap' Ethernet bridging mode,     openvpn can exhaust its memory by receiving a large     number of spoofed MAC addresses and hence denying     service.

  - CAN-2005-2534

    Simultaneous TCP connections from multiple clients with     the same client certificate can cause a denial of     service when--duplicate-cn is not enabled.

ID	Name	Product	Family	Severity
125261	OpenVPN < 2.0.1 Multiple Vulnerabilities (Windows)	Nessus	Windows	medium
21513	FreeBSD : openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients (d1c39c8e-05ab-4739-870f-765490fa2052)	Nessus	FreeBSD Local Security Checks	medium
19959	Debian DSA-851-1 : openvpn - programming errors	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2005-2532

medium

Tenable Plugins

medium

medium

medium