Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.

The remote host is affected by the vulnerability described in GLSA-202409-08 (OpenVPN: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenVPN. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e4df33666c advisory.

    This is an extended update of the OpenVPN 2.6.7 release which contains security fixes for CVE-2023-46849     and CVE-2023-46850.  That release had a regression causing the `openvpn` daemon to segfault frequently;
    which is why the 2.6.7 release was pulled.  This 2.6.8 release contains a fix for the regression issue as     well.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d9d55a0bfc advisory.

    This is an extended update of the OpenVPN 2.6.7 release which contains security fixes for CVE-2023-46849     and CVE-2023-46850.  That release had a regression causing the `openvpn` daemon to segfault frequently;
    which is why the 2.6.7 release was pulled.  This 2.6.8 release contains a fix for the regression issue as     well.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.04 / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6484-1 advisory.

    It was discovered that OpenVPN incorrectly handled the --fragment option in certain configurations. A     remote attacker could possibly use this issue to cause OpenVPN to crash, resulting in a denial of service.
    (CVE-2023-46849)

    It was discovered that OpenVPN incorrectly handled certain memory operations. A remote attacker could use     this issue to cause OpenVPN to crash, obtain sensitive information, or possibly execute arbitrary code.
    (CVE-2023-46850)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5555 advisory.

  - Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an     attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial     of service. (CVE-2023-46849)

  - Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or     remote execution when sending network buffers to a remote peer. (CVE-2023-46850)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2fe004f5-83fd-11ee-9f5d-31909fb2f495 advisory.

  - Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an     attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial     of service. (CVE-2023-46849)

  - Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or     remote execution when sending network buffers to a remote peer. (CVE-2023-46850)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
207570	GLSA-202409-08 : OpenVPN: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
186390	Fedora 38 : openvpn (2023-e4df33666c)	Nessus	Fedora Local Security Checks	critical
186203	Fedora 39 : openvpn (2023-d9d55a0bfc)	Nessus	Fedora Local Security Checks	critical
185910	Ubuntu 23.04 / 23.10 : OpenVPN vulnerabilities (USN-6484-1)	Nessus	Ubuntu Local Security Checks	critical
185812	Debian DSA-5555-1 : openvpn - security update	Nessus	Debian Local Security Checks	critical
185811	FreeBSD : openvpn -- 2.6.0...2.6.6 --fragment option division by zero crash, and TLS data leak (2fe004f5-83fd-11ee-9f5d-31909fb2f495)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2023-46850

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical