OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.

According to its self-reported version number, the version of OpenVPN installed on the remote Windows host is prior to 2.3.15 or 2.4.x prior to 2.4.2. It is, therefore, affected by a denial of service vulnerability due to the unchecked rolling over of its packet-ID counter. An unauthenticated, remote attacker can exploit this issue, by sending a large number of packets, to cause the application to stop responding.

This update for openvpn fixes the following security issues :

  - CVE-2017-12166: OpenVPN was vulnerable to a buffer     overflow vulnerability when key-method 1 is used,     possibly resulting in code execution. (bsc#1060877).

  - CVE-2016-6329: Now show which ciphers should no longer     be used in openvpn --show-ciphers to avoid the SWEET32     attack (bsc#995374)

  - CVE-2017-7478: OpenVPN was vulnerable to unauthenticated     Denial of Service of server via received large control     packet. (bsc#1038709)

  - CVE-2017-7479: OpenVPN was vulnerable to reachable     assertion when packet-ID counter rolls over resulting     into Denial of Service of server by authenticated     attacker. (bsc#1038711)

  - Some other hardening fixes have also been applied     (bsc#1038713)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings in the latest OpenVPN v2.4.2 release. This release contains fixes for two authenticated remote DoS vulnerabilities (CVE-2017-7478 and CVE-2017-7479). For more information see the upstream [security announcement](http://community.openvpn.net/openvpn/wiki/QuarkslabAndCr yptographyEngineerAudits).

This build also switches back to OpenSSL 1.0, using compat-openssl10 and compat-openssl10-pkcs11-helper. This is temporarily until full OpenSSL 1.1 support have arrived OpenVPN. This should also resolve a lot of issues with features missing or not working properly with mbed TLS.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openvpn fixes the following issues :

  - CVE-2016-6329: Show which ciphers should no longer be     used in openvpn --show-ciphers (bsc#995374)

  - CVE-2017-7478: openvpn: Authenticated user can DoS     server by using a big payload in P_CONTROL (bsc#1038709)

  - CVE-2017-7479: openvpn: Denial of Service due to     Exhaustion of Packet-ID counter (bsc#1038711)

  - Hardening measures found by internal audit (bsc#1038713)

This update was imported from the SUSE:SLE-12:Update update project.

Several issues were discovered in openvpn, a virtual private network application.

  - CVE-2017-7479     It was discovered that openvpn did not properly handle     the rollover of packet identifiers. This would allow an     authenticated remote attacker to cause a     denial-of-service via application crash.

  - CVE-2017-7508     Guido Vranken discovered that openvpn did not properly     handle specific malformed IPv6 packets. This would allow     a remote attacker to cause a denial-of-service via     application crash.

  - CVE-2017-7520     Guido Vranken discovered that openvpn did not properly     handle clients connecting to an HTTP proxy with NTLMv2     authentication. This would allow a remote attacker to     cause a denial-of-service via application crash, or     potentially leak sensitive information like the user's     proxy password.

  - CVE-2017-7521     Guido Vranken discovered that openvpn did not properly     handle some x509 extensions. This would allow a remote     attacker to cause a denial-of-service via application     crash.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3339-1 advisory.

    Karthikeyan Bhargavan and Gatan Leurent discovered that 64-bit block ciphers are vulnerable to a     birthday attack. A remote attacker could possibly use this issue to recover cleartext data. Fixing this     issue requires a configuration change to switch to a different cipher. This update adds a warning to the     log file when a 64-bit block cipher is in use. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS     and Ubuntu 16.10. (CVE-2016-6329)

    It was discovered that OpenVPN incorrectly handled rollover of packet ids. An authenticated remote     attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-7479)

    Guido Vranken discovered that OpenVPN incorrectly handled certain malformed IPv6 packets. A remote     attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service. (CVE-2017-7508)

    Guido Vranken discovered that OpenVPN incorrectly handled memory. A remote attacker could use this issue     to cause OpenVPN to crash, resulting in a denial of service. (CVE-2017-7512)

    Guido Vranken discovered that OpenVPN incorrectly handled an HTTP proxy with NTLM authentication. A remote     attacker could use this issue to cause OpenVPN clients to crash, resulting in a denial of service, or     possibly expose sensitive memory contents. (CVE-2017-7520)

    Guido Vranken discovered that OpenVPN incorrectly handled certain x509 extensions. A remote attacker could     use this issue to cause OpenVPN to crash, resulting in a denial of service. (CVE-2017-7521)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for openvpn fixes the following issues :

  - CVE-2016-6329: Show which ciphers should no longer be     used in openvpn

    --show-ciphers (bsc#995374)

  - CVE-2017-7478: openvpn: Authenticated user can DoS     server by using a big payload in P_CONTROL (bsc#1038709)

  - CVE-2017-7479: openvpn: Denial of Service due to     Exhaustion of Packet-ID counter (bsc#1038711)

  - Hardening measures found by internal audit (bsc#1038713)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for two remote DoS issues (CVE-2017-7478, CVE-2017-7479)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Denial of Service due to Exhaustion of Packet-ID counter

An authenticated client can cause the server's the packet-id counter to roll over, which would lead the server process to hit an ASSERT() and stop running. To make the server hit the ASSERT(), the client must first cause the server to send it 2^32 packets (at least 196GB). For Debian 7 'Wheezy', these problems have been fixed in version 2.2.1-8+deb7u4.

We recommend that you upgrade your openvpn packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update brings in the latest OpenVPN v2.4.2 release. This release contains fixes for two authenticated remote DoS vulnerabilities (CVE-2017-7478 and CVE-2017-7479).

For more information see the upstream [security announcement](http://community.openvpn.net/openvpn/wiki/QuarkslabAndCr yptographyEngineerAudits).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that OpenVPN improperly triggered an assert when receiving an oversized control packet in some situations. A remote attacker could use this to cause a denial of service (server or client crash). (CVE-2017-7478)

It was discovered that OpenVPN improperly triggered an assert when packet ids rolled over. An authenticated remote attacker could use this to cause a denial of service (application crash). (CVE-2017-7479).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Samuli Seppanen reports :

OpenVPN v2.4.0 was audited for security vulnerabilities independently by Quarkslabs (funded by OSTIF) and Cryptography Engineering (funded by Private Internet Access) between December 2016 and April 2017. The primary findings were two remote denial-of-service vulnerabilities.
Fixes to them have been backported to v2.3.15.

An authenticated client can do the 'three way handshake' (P_HARD_RESET, P_HARD_RESET, P_CONTROL), where the P_CONTROL packet is the first that is allowed to carry payload. If that payload is too big, the OpenVPN server process will stop running due to an ASSERT() exception. That is also the reason why servers using tls-auth/tls-crypt are protected against this attack - the P_CONTROL packet is only accepted if it contains the session ID we specified, with a valid HMAC (challenge-response). (CVE-2017-7478)

An authenticated client can cause the server's the packet-id counter to roll over, which would lead the server process to hit an ASSERT() and stop running. To make the server hit the ASSERT(), the client must first cause the server to send it 2^32 packets (at least 196 GB).

ID	Name	Product	Family	Severity
125257	OpenVPN < 2.3.15 / 2.4.x < 2.4.2 Denial of Service Vulnerability (Windows)	Nessus	Windows	medium
104141	SUSE SLES11 Security Update : openvpn (SUSE-SU-2017:2838-1) (SWEET32)	Nessus	SuSE Local Security Checks	high
101679	Fedora 26 : openvpn (2017-89d98779ec)	Nessus	Fedora Local Security Checks	high
101128	openSUSE Security Update : openvpn (openSUSE-2017-717) (SWEET32)	Nessus	SuSE Local Security Checks	high
101067	Debian DSA-3900-1 : openvpn - security update	Nessus	Debian Local Security Checks	high
101024	Ubuntu 14.04 LTS / 16.04 LTS : OpenVPN vulnerabilities (USN-3339-1)	Nessus	Ubuntu Local Security Checks	critical
100951	SUSE SLED12 / SLES12 Security Update : openvpn (SUSE-SU-2017:1622-1) (SWEET32)	Nessus	SuSE Local Security Checks	high
100363	Fedora 24 : openvpn (2017-f426acf49d)	Nessus	Fedora Local Security Checks	high
100226	Debian DLA-944-1 : openvpn security update	Nessus	Debian Local Security Checks	medium
100183	Fedora 25 : openvpn (2017-0d0f18140a)	Nessus	Fedora Local Security Checks	high
100155	Ubuntu 17.04 : openvpn vulnerabilities (USN-3284-1)	Nessus	Ubuntu Local Security Checks	high
100140	FreeBSD : OpenVPN -- two remote denial-of-service vulnerabilities (04cc7bd2-3686-11e7-aa64-080027ef73ec)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-7479

medium

Tenable Plugins

medium

high

high

high

high

critical

high

high

medium

high

high

high