ArchLinux: 201705-16: openvpn: denial of service
Summary
- CVE-2017-7478 (denial of service)
A security issue has been found in OpenVPN <= 2.4.1 where an
unauthenticated attacker can send a packet with an unexpected payload
size during SSL handshake, causing a server shutdown. Servers using
tls-auth are protected against this attack as packets with an invalid
HMAC are discarded before being processed by the vulnerable code.
- CVE-2017-7479 (denial of service)
A security issue has been found in OpenVPN <= 2.4.1 where an
authenticated attacker can crash a server using an AEAD mode cipher by
sending crafted data to exhaust the packet counter.
Resolution
Upgrade to 2.4.2-1.
# pacman -Syu "openvpn>=2.4.2-1"
The problems have been fixed upstream in version 2.4.2.
References
https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits https://ostif.org/the-openvpn-2-4-0-audit-by-ostif-and-quarkslab-results/ https://blog.quarkslab.com/security-assessment-of-openvpn.html https://security.archlinux.org/CVE-2017-7478 https://security.archlinux.org/CVE-2017-7479
Workaround
The most severe vulnerability, CVE-2017-7478, which allows a remote unauthenticated attacker to cause a denial of service, can be mitigated by setting up tls-auth or tls-crypt. Note that this requires changing both server and clients configurations.