OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.

According to its self-reported version number, the version of OpenVPN installed on the remote Windows host is 2.3.12 prior to 2.3.15 or 2.4.x prior to 2.4.2. It is, therefore, affected by a denial of service (DoS) vulnerability due to invalid packet processing logic. An unauthenticated, remote attacker can exploit this issue, by sending a large control packet, to cause the application to stop responding.

This update for openvpn fixes the following security issues :

  - CVE-2017-12166: OpenVPN was vulnerable to a buffer     overflow vulnerability when key-method 1 is used,     possibly resulting in code execution. (bsc#1060877).

  - CVE-2016-6329: Now show which ciphers should no longer     be used in openvpn --show-ciphers to avoid the SWEET32     attack (bsc#995374)

  - CVE-2017-7478: OpenVPN was vulnerable to unauthenticated     Denial of Service of server via received large control     packet. (bsc#1038709)

  - CVE-2017-7479: OpenVPN was vulnerable to reachable     assertion when packet-ID counter rolls over resulting     into Denial of Service of server by authenticated     attacker. (bsc#1038711)

  - Some other hardening fixes have also been applied     (bsc#1038713)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings in the latest OpenVPN v2.4.2 release. This release contains fixes for two authenticated remote DoS vulnerabilities (CVE-2017-7478 and CVE-2017-7479). For more information see the upstream [security announcement](http://community.openvpn.net/openvpn/wiki/QuarkslabAndCr yptographyEngineerAudits).

This build also switches back to OpenSSL 1.0, using compat-openssl10 and compat-openssl10-pkcs11-helper. This is temporarily until full OpenSSL 1.1 support have arrived OpenVPN. This should also resolve a lot of issues with features missing or not working properly with mbed TLS.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openvpn fixes the following issues :

  - CVE-2016-6329: Show which ciphers should no longer be     used in openvpn --show-ciphers (bsc#995374)

  - CVE-2017-7478: openvpn: Authenticated user can DoS     server by using a big payload in P_CONTROL (bsc#1038709)

  - CVE-2017-7479: openvpn: Denial of Service due to     Exhaustion of Packet-ID counter (bsc#1038711)

  - Hardening measures found by internal audit (bsc#1038713)

This update was imported from the SUSE:SLE-12:Update update project.

This update for openvpn fixes the following issues :

  - CVE-2016-6329: Show which ciphers should no longer be     used in openvpn

    --show-ciphers (bsc#995374)

  - CVE-2017-7478: openvpn: Authenticated user can DoS     server by using a big payload in P_CONTROL (bsc#1038709)

  - CVE-2017-7479: openvpn: Denial of Service due to     Exhaustion of Packet-ID counter (bsc#1038711)

  - Hardening measures found by internal audit (bsc#1038713)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for two remote DoS issues (CVE-2017-7478, CVE-2017-7479)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings in the latest OpenVPN v2.4.2 release. This release contains fixes for two authenticated remote DoS vulnerabilities (CVE-2017-7478 and CVE-2017-7479).

For more information see the upstream [security announcement](http://community.openvpn.net/openvpn/wiki/QuarkslabAndCr yptographyEngineerAudits).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that OpenVPN improperly triggered an assert when receiving an oversized control packet in some situations. A remote attacker could use this to cause a denial of service (server or client crash). (CVE-2017-7478)

It was discovered that OpenVPN improperly triggered an assert when packet ids rolled over. An authenticated remote attacker could use this to cause a denial of service (application crash). (CVE-2017-7479).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Samuli Seppanen reports :

OpenVPN v2.4.0 was audited for security vulnerabilities independently by Quarkslabs (funded by OSTIF) and Cryptography Engineering (funded by Private Internet Access) between December 2016 and April 2017. The primary findings were two remote denial-of-service vulnerabilities.
Fixes to them have been backported to v2.3.15.

An authenticated client can do the 'three way handshake' (P_HARD_RESET, P_HARD_RESET, P_CONTROL), where the P_CONTROL packet is the first that is allowed to carry payload. If that payload is too big, the OpenVPN server process will stop running due to an ASSERT() exception. That is also the reason why servers using tls-auth/tls-crypt are protected against this attack - the P_CONTROL packet is only accepted if it contains the session ID we specified, with a valid HMAC (challenge-response). (CVE-2017-7478)

An authenticated client can cause the server's the packet-id counter to roll over, which would lead the server process to hit an ASSERT() and stop running. To make the server hit the ASSERT(), the client must first cause the server to send it 2^32 packets (at least 196 GB).

ID	Name	Product	Family	Severity
125259	OpenVPN 2.3.12 < 2.3.15 / 2.4.x < 2.4.2 Denial of Service Vulnerability (Windows)	Nessus	Windows	high
104141	SUSE SLES11 Security Update : openvpn (SUSE-SU-2017:2838-1) (SWEET32)	Nessus	SuSE Local Security Checks	high
101679	Fedora 26 : openvpn (2017-89d98779ec)	Nessus	Fedora Local Security Checks	high
101128	openSUSE Security Update : openvpn (openSUSE-2017-717) (SWEET32)	Nessus	SuSE Local Security Checks	high
100951	SUSE SLED12 / SLES12 Security Update : openvpn (SUSE-SU-2017:1622-1) (SWEET32)	Nessus	SuSE Local Security Checks	high
100363	Fedora 24 : openvpn (2017-f426acf49d)	Nessus	Fedora Local Security Checks	high
100183	Fedora 25 : openvpn (2017-0d0f18140a)	Nessus	Fedora Local Security Checks	high
100155	Ubuntu 17.04 : openvpn vulnerabilities (USN-3284-1)	Nessus	Ubuntu Local Security Checks	high
100140	FreeBSD : OpenVPN -- two remote denial-of-service vulnerabilities (04cc7bd2-3686-11e7-aa64-080027ef73ec)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-7478

high

Tenable Plugins

high

high

high

high

high

high

high

high

high