A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XMLHttpRequest actions in a web browser. This is demonstrated by a multipart/form-data POST to http://localhost:23000 with a "signal SIGTERM" command in a TEXTAREA element. NOTE: The vendor disputes that this is a vulnerability. They state that this is the result of improper configuration of the OpenVPN instance rather than an intrinsic vulnerability, and now more explicitly warn against such configurations in both the management-interface documentation, and with a runtime warning

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14723-1 advisory.

  - ** DISPUTED ** A cross-protocol scripting issue was discovered in the management interface in OpenVPN     through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are     connected to this interface, attackers can execute arbitrary management commands, obtain sensitive     information, or cause a denial of service (SIGTERM) by triggering XMLHttpRequest actions in a web browser.
    This is demonstrated by a multipart/form-data POST to http://localhost:23000 with a signal SIGTERM     command in a TEXTAREA element. NOTE: The vendor disputes that this is a vulnerability. They state that     this is the result of improper configuration of the OpenVPN instance rather than an intrinsic     vulnerability, and now more explicitly warn against such configurations in both the management-interface     documentation, and with a runtime warning. (CVE-2018-7544)

  - OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control     channel data on servers configured with deferred authentication, which can be used to potentially trigger     further information leaks. (CVE-2020-15078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for openvpn fixes the following issues :

  - CVE-2020-15078: Fixed authentication bypass with     deferred authentication (bsc#1185279).

  - CVE-2020-11810: Fixed race condition between allocating     peer-id and initializing data channel key (bsc#1169925).

  - CVE-2018-7544: Fixed cross-protocol scripting issue that     was discovered in the management interface     (bsc#1085803).

This update was imported from the SUSE:SLE-15:Update update project.

This update for openvpn fixes the following issues :

CVE-2020-15078: Fixed authentication bypass with deferred authentication (bsc#1185279).

CVE-2018-7544: Fixed cross-protocol scripting issue that was discovered in the management interface (bsc#1085803).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openvpn fixes the following issues :

CVE-2020-15078: Fixed authentication bypass with deferred authentication (bsc#1185279).

CVE-2020-11810: Fixed race condition between allocating peer-id and initializing data channel key (bsc#1169925).

CVE-2018-7544: Fixed cross-protocol scripting issue that was discovered in the management interface (bsc#1085803).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
150543	SUSE SLES11 Security Update : openvpn-openssl1 (SUSE-SU-2021:14723-1)	Nessus	SuSE Local Security Checks	critical
149641	openSUSE Security Update : openvpn (openSUSE-2021-734)	Nessus	SuSE Local Security Checks	critical
149461	SUSE SLES12 Security Update : openvpn (SUSE-SU-2021:1576-1)	Nessus	SuSE Local Security Checks	critical
149458	SUSE SLED15 / SLES15 Security Update : openvpn (SUSE-SU-2021:1577-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2018-7544

critical

Tenable Plugins

critical

critical

critical

critical