OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler.

According to its self-reported version number, the version of OpenVPN server installed on the remote Windows host is version 2.0.x prior to 2.0.4. It is, therefore, affected by a denial of service (DoS) vulnerability in its TCP/IP accept function component. An unauthenticated, remote attacker can exploit this issue, by forcing the accept function to return an error status which leads to a null dereference in an exception handler, to cause the application to stop responding.

Several vulnerabilities have been discovered in OpenVPN, a free virtual private network daemon. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-3393     A format string vulnerability has been discovered that     could allow arbitrary code to be executed on the client.

  - CVE-2005-3409     A NULL pointer dereferencing has been discovered that     could be exploited to crash the service.

James Yonan reports :

If the TCP server accept() call returns an error status, the resulting exception handler may attempt to indirect through a NULL pointer, causing a segfault. Affects all OpenVPN 2.0 versions.

Two Denial of Service vulnerabilities exist in OpenVPN. The first allows a malicious or compromised server to execute arbitrary code on the client (CVE-2005-3393). The second DoS can occur if when in TCP server mode, OpenVPN received an error on accept(2) and the resulting exception handler causes a segfault (CVE-2005-3409).

The updated packages have been patched to correct these problems.

Update :

Packages are now available for Mandriva Linux 2006.

The remote host is affected by the vulnerability described in GLSA-200511-07 (OpenVPN: Multiple vulnerabilities)

    The OpenVPN client contains a format string bug in the handling of     the foreign_option in options.c. Furthermore, when the OpenVPN server     runs in TCP mode, it may dereference a NULL pointer under specific     error conditions.
  Impact :

    A remote attacker could setup a malicious OpenVPN server and trick     the user into connecting to it, potentially executing arbitrary code on     the client's computer. A remote attacker could also exploit the NULL     dereference issue by sending specific packets to an OpenVPN server     running in TCP mode, resulting in a Denial of Service condition.
  Workaround :

    Do not use 'pull' or 'client' options in the OpenVPN client     configuration file, and use UDP mode for the OpenVPN server.

ID	Name	Product	Family	Severity
128773	OpenVPN Server 2.0.x < 2.0.4 Denial of Service Vulnerability	Nessus	Windows	medium
22751	Debian DSA-885-1 : openvpn - several vulnerabilities	Nessus	Debian Local Security Checks	high
21416	FreeBSD : openvpn -- potential denial-of-service on servers in TCP mode (3de49331-0dec-422c-93e5-e4719e9869c5)	Nessus	FreeBSD Local Security Checks	medium
20440	Mandrake Linux Security Advisory : openvpn (MDKSA-2005:206-1)	Nessus	Mandriva Local Security Checks	high
20157	GLSA-200511-07 : OpenVPN: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2005-3409

high

Tenable Plugins

medium

high

medium

high

high