Ubuntu 17.04: USN-3339-1 Critical: OpenVPN Denial Of Service Issues

ubuntu

June 22, 2017

Several security issues were fixed in OpenVPN.

Summary

Several security issues were fixed in OpenVPN.

Software Description:

- openvpn: virtual private network software

Details:

Karthikeyan Bhargavan and Gaëtan Leurent discovered that 64-bit block

ciphers are vulnerable to a birthday attack. A remote attacker could

possibly use this issue to recover cleartext data. Fixing this issue

requires a configuration change to switch to a different cipher. This

update adds a warning to the log file when a 64-bit block cipher is in use.

This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and

Ubuntu 16.10. (CVE-2016-6329)

It was discovered that OpenVPN incorrectly handled rollover of packet ids.

An authenticated remote attacker could use this issue to cause OpenVPN to

crash, resulting in a denial of service. This issue only affected Ubuntu

14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-7479)

Guido Vranken discovered that OpenVPN incorrectly handled certain malformed

IPv6 packets. A remote attacker could ...

Read the Full Advisory

Topics Covered

security advisory denial of service critical issue Ubuntu update instructions OpenVPN

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  openvpn                         2.4.0-4ubuntu1.3

Ubuntu 16.10:
  openvpn                         2.3.11-1ubuntu2.1

Ubuntu 16.04 LTS:
  openvpn                         2.3.10-1ubuntu2.1

Ubuntu 14.04 LTS:
  openvpn                         2.3.2-7ubuntu3.2

In general, a standard system update will make all the necessary changes.