OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().

According to its self-reported version number, the version of OpenVPN installed on the remote Windows host is 2.3.x prior to 2.3.17 or 2.4.x prior to 2.4.3. It is, therefore, affected by multiple denial of service (DoS) vulnerabilities due to invalid input validation. An unauthenticated, remote attacker can exploit this issue, by sending malformed input, to cause the application to stop responding.

Updates to the latest upstream OpenVPN 2.4.3, containing security updates for CVE-2017-7508, CVE-2017-7520 and CVE-2017-7521. This update also re-enables automatic restart of OpenVPN on the next updates. For this update, the restart needs to be done manually.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updates to the latest upstream OpenVPN 2.3.17, containing security updates for CVE-2017-7508, CVE-2017-7520 and CVE-2017-7521.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openvpn fixes the following issues :

  - Some parts of the certificate-parsing code did not     always clear all allocated memory. This would have     allowed clients to leak a few bytes of memory for each     connection attempt, thereby facilitating a (quite     inefficient) DoS attack on the server. [bsc#1044947,     CVE-2017-7521]

  - The ASN1 parsing code contained a bug that could have     resulted in some buffers being free()d twice, and this     issue could have potentially been triggered remotely by     a VPN peer. [bsc#1044947, CVE-2017-7521]

  - If clients used a HTTP proxy with NTLM authentication, a     man-in-the-middle attacker between client and proxy     could cause the client to crash or disclose at most 96     bytes of stack memory. The disclosed stack memory was     likely to contain the proxy password. If the proxy     password had not been reused, this was unlikely to     compromise the security of the OpenVPN tunnel itself.
    Clients who did not use the --http-proxy option with     ntlm2 authentication were not affected. [bsc#1044947,     CVE-2017-7520]

  - It was possible to trigger an assertion by sending a     malformed IPv6 packet. That issue could have been abused     to remotely shutdown an openvpn server or client, if     IPv6 and --mssfix were enabled and if the IPv6 networks     used inside the VPN were known. [bsc#1044947,     CVE-2017-7508]

This update was imported from the SUSE:SLE-12:Update update project.

Several issues were discovered in openvpn, a virtual private network application.

  - CVE-2017-7479     It was discovered that openvpn did not properly handle     the rollover of packet identifiers. This would allow an     authenticated remote attacker to cause a     denial-of-service via application crash.

  - CVE-2017-7508     Guido Vranken discovered that openvpn did not properly     handle specific malformed IPv6 packets. This would allow     a remote attacker to cause a denial-of-service via     application crash.

  - CVE-2017-7520     Guido Vranken discovered that openvpn did not properly     handle clients connecting to an HTTP proxy with NTLMv2     authentication. This would allow a remote attacker to     cause a denial-of-service via application crash, or     potentially leak sensitive information like the user's     proxy password.

  - CVE-2017-7521     Guido Vranken discovered that openvpn did not properly     handle some x509 extensions. This would allow a remote     attacker to cause a denial-of-service via application     crash.

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.
(CVE-2017-7508)

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character. (CVE-2017-7522)

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().
(CVE-2017-7521)

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker. (CVE-2017-7520)

Karthikeyan Bhargavan and Gaetan Leurent discovered that 64-bit block ciphers are vulnerable to a birthday attack. A remote attacker could possibly use this issue to recover cleartext data. Fixing this issue requires a configuration change to switch to a different cipher. This update adds a warning to the log file when a 64-bit block cipher is in use. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-6329)

It was discovered that OpenVPN incorrectly handled rollover of packet ids. An authenticated remote attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
(CVE-2017-7479)

Guido Vranken discovered that OpenVPN incorrectly handled certain malformed IPv6 packets. A remote attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service.
(CVE-2017-7508)

Guido Vranken discovered that OpenVPN incorrectly handled memory. A remote attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service. (CVE-2017-7512)

Guido Vranken discovered that OpenVPN incorrectly handled an HTTP proxy with NTLM authentication. A remote attacker could use this issue to cause OpenVPN clients to crash, resulting in a denial of service, or possibly expose sensitive memory contents. (CVE-2017-7520)

Guido Vranken discovered that OpenVPN incorrectly handled certain x509 extensions. A remote attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service. (CVE-2017-7521).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openvpn fixes the following issues :

  - Some parts of the certificate-parsing code did not     always clear all allocated memory. This would have     allowed clients to leak a few bytes of memory for each     connection attempt, thereby facilitating a (quite     inefficient) DoS attack on the server. [bsc#1044947,     CVE-2017-7521]

  - The ASN1 parsing code contained a bug that could have     resulted in some buffers being free()d twice, and this     issue could have potentially been triggered remotely by     a VPN peer. [bsc#1044947, CVE-2017-7521]

  - If clients used a HTTP proxy with NTLM authentication, a     man-in-the-middle attacker between client and proxy     could cause the client to crash or disclose at most 96     bytes of stack memory. The disclosed stack memory was     likely to contain the proxy password. If the proxy     password had not been reused, this was unlikely to     compromise the security of the OpenVPN tunnel itself.
    Clients who did not use the

    --http-proxy option with ntlm2 authentication were not     affected. [bsc#1044947, CVE-2017-7520]

  - It was possible to trigger an assertion by sending a     malformed IPv6 packet. That issue could have been abused     to remotely shutdown an openvpn server or client, if     IPv6 and --mssfix were enabled and if the IPv6 networks     used inside the VPN were known. [bsc#1044947,     CVE-2017-7508]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Samuli Seppanen reports :

In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In the process he found several vulnerabilities and reported them to the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.

This is a list of fixed important vulnerabilities :

- Remotely-triggerable ASSERT() on malformed IPv6 packet

- Pre-authentication remote crash/information disclosure for clients

- Potential double-free in --x509-alt-username

- Remote-triggerable memory leaks

- Post-authentication remote DoS when using the --x509-track option

- NULL pointer dereference in establish_http_proxy_passthru()

New openvpn packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

ID	Name	Product	Family	Severity
125262	OpenVPN 2.3.x < 2.3.17 & 2.4.x < 2.4.3 Multiple Denial of Service Vulnerabilites (Windows)	Nessus	Windows	high
101748	Fedora 26 : openvpn (2017-f8a114cd09)	Nessus	Fedora Local Security Checks	high
101180	Fedora 24 : openvpn (2017-5596f2f94d)	Nessus	Fedora Local Security Checks	high
101131	openSUSE Security Update : openvpn (openSUSE-2017-730)	Nessus	SuSE Local Security Checks	high
101067	Debian DSA-3900-1 : openvpn - security update	Nessus	Debian Local Security Checks	high
101064	Amazon Linux AMI : openvpn (ALAS-2017-852)	Nessus	Amazon Linux Local Security Checks	high
101036	Fedora 25 : openvpn (2017-0639fb1490)	Nessus	Fedora Local Security Checks	high
101024	Ubuntu 14.04 LTS / 16.04 LTS : OpenVPN vulnerabilities (USN-3339-1)	Nessus	Ubuntu Local Security Checks	critical
100985	SUSE SLED12 / SLES12 Security Update : openvpn (SUSE-SU-2017:1635-1)	Nessus	SuSE Local Security Checks	high
100976	FreeBSD : OpenVPN -- several vulnerabilities (9f65d382-56a4-11e7-83e3-080027ef73ec)	Nessus	FreeBSD Local Security Checks	critical
100964	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : openvpn (SSA:2017-172-01)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2017-7521

medium

Tenable Plugins

high

high

high

high

high

high

high

critical

high

critical

critical