This script is Copyright (C) 2017 Tenable Network Security, Inc.
The remote FreeBSD host is missing one or more security-related
Steffan Karger reports :
The bounds check in read_key() was performed after using the value,
instead of before. If 'key-method 1' is used, this allowed an attacker
to send a malformed packet to trigger a stack-based buffer overflow. [...]
Note that 'key-method 1' has been replaced by 'key method 2' as the
default in OpenVPN 2.0 (released on 2005-04-17), and explicitly
deprecated in 2.4 and marked for removal in 2.5. This should limit the
amount of users impacted by this issue.
See also :
Update the affected packages.
Risk factor :
Medium / CVSS Base Score : 6.8