Detections
Analytics
OpenVPN Unprotected Management Interface
medium Nessus Plugin ID 21330
Language:
Synopsis
The remote VPN server can be managed remotely without authentication.Description
The remote host is running OpenVPN, an open source SSL VPN.The version of OpenVPN installed on the remote host does not require authentication to access the server's management interface. An attacker can leverage this issue to gain complete control over the affected application simply by telneting in.
Solution
Disable the management interface or bind it only to a specific address, such as 127.0.0.1.See Also
https://www.securityfocus.com/archive/1/432863/30/60/threaded
https://openvpn.net/community-resources/reference-manual-for-openvpn-2-0/
Plugin Details
Severity: Medium
ID: 21330
File Name: openvpn_management_interface_accessible.nasl
Version: 1.19
Type: remote
Family: Misc.
Published: 5/8/2006
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.7
CVSS v2
Risk Factor: Medium
Base Score: 4
Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:P
Vulnerability Information
CPE: cpe:/a:openvpn:openvpn
Vulnerability Publication Date: 5/3/2006
Reference Information
CVE: CVE-2006-2229