The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.

According to its self-reported version number, the version of OpenVPN installed on the remote Windows host is prior to 2.3.1. It is, therefore, affected by an information disclosure vulnerability in the crypto.c component due to its HMAC comparison function not running in constant time. An unauthenticated, remote attacker can exploit this, via a timing attack, to disclose potentially sensitive information.

It was discovered that OpenVPN incorrectly handled HMAC comparisons when running in UDP mode. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could possibly be used to perform a plaintext recovery attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following security issues were fixed :

  - Applied upstream patch changing to use a constant time     memcmp when comparing HMACs in openvpn_decrypt to     address ciphertext injection in UDP mode (CVE-2013-2061,     bnc#843509).
    [0006-openvpn-2.0.9-HMAC-memcmp-CVE-2013-2061_bnc843509.
    patch]

Changes in openvpn :

  - Applied upstream patch changing to use a constant time     memcmp when comparing HMACs in openvpn_decrypt to     address ciphertext injection in UDP mode (CVE-2013-2061,     bnc#843509).
    [0006-openvpn-2.0.9-HMAC-memcmp-CVE-2013-2061_bnc843509.
    patch]

OpenVPN used a non-constant-time memcmp in HMAC comparison in openvpn_decrypt that might have allowed remote attackers to gain knowledge of plaintext data. (CVE-2013-2061)

The remote host is affected by the vulnerability described in GLSA-201311-13 (OpenVPN: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenVPN. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to recover plaintext from an encrypted       communication. Another vulnerability could allow remote attacker perform       a Man-in-the-Middle attack.
  Workaround :

    There is no known workaround at this time.

Updated openvpn package fixes security vulnerability :

OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen ciphertext injection due to a non-constant-time HMAC comparison function. Plaintext recovery may be possible using a padding oracle attack on the CBC mode cipher implementation of the crypto library, optimistically at a rate of about one character per 3 hours. PolarSSL seems vulnerable to such an attack; the vulnerability of OpenSSL has not been verified or tested (CVE-2013-2061).

Fix for SSL vulnerability.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The OpenVPN project reports :

OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen ciphertext injection due to a non-constant-time HMAC comparison function.

ID	Name	Product	Family	Severity
125260	OpenVPN < 2.3.1 Information Disclosure Vulnerability (Windows)	Nessus	Windows	low
78041	Ubuntu 12.04 LTS : openvpn vulnerability (USN-2368-1)	Nessus	Ubuntu Local Security Checks	low
75191	openSUSE Security Update : openvpn (openSUSE-SU-2013:1645-1)	Nessus	SuSE Local Security Checks	low
71137	SuSE 11.3 Security Update : openvpn (SAT Patch Number 8493)	Nessus	SuSE Local Security Checks	low
71136	SuSE 11.2 Security Update : openvpn (SAT Patch Number 8496)	Nessus	SuSE Local Security Checks	low
70997	GLSA-201311-13 : OpenVPN: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
69759	Amazon Linux AMI : openvpn (ALAS-2013-201)	Nessus	Amazon Linux Local Security Checks	low
66614	Mandriva Linux Security Advisory : openvpn (MDVSA-2013:167)	Nessus	Mandriva Local Security Checks	low
66453	Fedora 17 : openvpn-2.3.1-2.fc17 (2013-7552)	Nessus	Fedora Local Security Checks	low
66452	Fedora 18 : openvpn-2.3.1-2.fc18 (2013-7531)	Nessus	Fedora Local Security Checks	low
65846	FreeBSD : OpenVPN -- potential side-channel/timing attack when comparing HMACs (92f30415-9935-11e2-ad4c-080027ef73ec)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2013-2061

medium

Tenable Plugins

low

low

low

low

low

medium

low

low

low

low

low