openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation.

According to its self-reported version number, the version of OpenVPN installed on the remote Windows host is affected by a denial of service (DoS) vulnerability in its interactive service helper component due to an invalid level of validation for incoming requests. An unauthenticated, local attacker can exploit this issue, by sending malformed requests, to cause the application to stop responding.

This update for openvpn fixes the following issues :

  - CVE-2018-9336: Fix potential double-free() in     Interactive Service could lead to denial of service     (bsc#1090839).

This update was imported from the SUSE:SLE-15:Update update project.

This update for openvpn fixes the following issues :

  - CVE-2018-9336: Fix potential double-free() in     Interactive Service could lead to denial of service     (bsc#1090839).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New openvpn packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue.

ID	Name	Product	Family	Severity
125263	OpenVPN 2.4.x < 2.4.6 Denial of Service Vulnerability (Windows)	Nessus	Windows	high
123212	openSUSE Security Update : openvpn (openSUSE-2019-507)	Nessus	SuSE Local Security Checks	high
120034	SUSE SLED15 / SLES15 Security Update : openvpn (SUSE-SU-2018:1888-1)	Nessus	SuSE Local Security Checks	high
110961	openSUSE Security Update : openvpn (openSUSE-2018-705)	Nessus	SuSE Local Security Checks	high
109362	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : openvpn (SSA:2018-116-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2018-9336

high

Tenable Plugins

high

high

high

high

high