Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512 maps to an OpenVPN vulnerability. The proper CVE ID for that OpenVPN vulnerability is CVE-2017-7521. Specifically, CVE-2017-7521 is the correct CVE ID for TWO closely related findings in OpenVPN. Any source that lists BOTH CVE-2017-7512 and CVE-2017-7521 for OpenVPN should have listed ONLY CVE-2017-7521.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3339-1 advisory.

    Karthikeyan Bhargavan and Gatan Leurent discovered that 64-bit block ciphers are vulnerable to a     birthday attack. A remote attacker could possibly use this issue to recover cleartext data. Fixing this     issue requires a configuration change to switch to a different cipher. This update adds a warning to the     log file when a 64-bit block cipher is in use. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS     and Ubuntu 16.10. (CVE-2016-6329)

    It was discovered that OpenVPN incorrectly handled rollover of packet ids. An authenticated remote     attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-7479)

    Guido Vranken discovered that OpenVPN incorrectly handled certain malformed IPv6 packets. A remote     attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service. (CVE-2017-7508)

    Guido Vranken discovered that OpenVPN incorrectly handled memory. A remote attacker could use this issue     to cause OpenVPN to crash, resulting in a denial of service. (CVE-2017-7512)

    Guido Vranken discovered that OpenVPN incorrectly handled an HTTP proxy with NTLM authentication. A remote     attacker could use this issue to cause OpenVPN clients to crash, resulting in a denial of service, or     possibly expose sensitive memory contents. (CVE-2017-7520)

    Guido Vranken discovered that OpenVPN incorrectly handled certain x509 extensions. A remote attacker could     use this issue to cause OpenVPN to crash, resulting in a denial of service. (CVE-2017-7521)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Samuli Seppanen reports :

In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In the process he found several vulnerabilities and reported them to the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.

This is a list of fixed important vulnerabilities :

- Remotely-triggerable ASSERT() on malformed IPv6 packet

- Pre-authentication remote crash/information disclosure for clients

- Potential double-free in --x509-alt-username

- Remote-triggerable memory leaks

- Post-authentication remote DoS when using the --x509-track option

- NULL pointer dereference in establish_http_proxy_passthru()

New openvpn packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

ID	Name	Product	Family	Severity
101024	Ubuntu 14.04 LTS / 16.04 LTS : OpenVPN vulnerabilities (USN-3339-1)	Nessus	Ubuntu Local Security Checks	critical
100976	FreeBSD : OpenVPN -- several vulnerabilities (9f65d382-56a4-11e7-83e3-080027ef73ec)	Nessus	FreeBSD Local Security Checks	critical
100964	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : openvpn (SSA:2017-172-01)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2017-7512

critical

Tenable Plugins

critical

critical

critical