OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.

According to its self-reported version number, the version of OpenVPN installed on the remote Windows host is 2.3.x prior to 2.3.17 or 2.4.x prior to 2.4.3. It is, therefore, affected by multiple denial of service (DoS) vulnerabilities due to invalid input validation. An unauthenticated, remote attacker can exploit this issue, by sending malformed input, to cause the application to stop responding.

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.
(CVE-2017-7508)

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character. (CVE-2017-7522)

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().
(CVE-2017-7521)

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker. (CVE-2017-7520)

Samuli Seppanen reports :

In May/June 2017 Guido Vranken threw a fuzzer at OpenVPN 2.4.2. In the process he found several vulnerabilities and reported them to the OpenVPN project. [...] The first releases to have these fixes are OpenVPN 2.4.3 and 2.3.17.

This is a list of fixed important vulnerabilities :

- Remotely-triggerable ASSERT() on malformed IPv6 packet

- Pre-authentication remote crash/information disclosure for clients

- Potential double-free in --x509-alt-username

- Remote-triggerable memory leaks

- Post-authentication remote DoS when using the --x509-track option

- NULL pointer dereference in establish_http_proxy_passthru()

New openvpn packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

ID	Name	Product	Family	Severity
125262	OpenVPN 2.3.x < 2.3.17 & 2.4.x < 2.4.3 Multiple Denial of Service Vulnerabilites (Windows)	Nessus	Windows	high
101064	Amazon Linux AMI : openvpn (ALAS-2017-852)	Nessus	Amazon Linux Local Security Checks	high
100976	FreeBSD : OpenVPN -- several vulnerabilities (9f65d382-56a4-11e7-83e3-080027ef73ec)	Nessus	FreeBSD Local Security Checks	critical
100964	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : openvpn (SSA:2017-172-01)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2017-7522

medium

Tenable Plugins

high

high

critical

critical