Arch Linux Security Advisory ASA-201705-16 ========================================== Severity: High Date : 2017-05-13 CVE-ID : CVE-2017-7478 CVE-2017-7479 Package : openvpn Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-271 Summary ======= The package openvpn before version 2.4.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.4.2-1. # pacman -Syu "openvpn>=2.4.2-1" The problems have been fixed upstream in version 2.4.2. Workaround ========== The most severe vulnerability, CVE-2017-7478, which allows a remote unauthenticated attacker to cause a denial of service, can be mitigated by setting up tls-auth or tls-crypt. Note that this requires changing both server and clients configurations. Description =========== - CVE-2017-7478 (denial of service) A security issue has been found in OpenVPN <= 2.4.1 where an unauthenticated attacker can send a packet with an unexpected payload size during SSL handshake, causing a server shutdown. Servers using tls-auth are protected against this attack as packets with an invalid HMAC are discarded before being processed by the vulnerable code. - CVE-2017-7479 (denial of service) A security issue has been found in OpenVPN <= 2.4.1 where an authenticated attacker can crash a server using an AEAD mode cipher by sending crafted data to exhaust the packet counter. Impact ====== A remote, unauthenticated attacker can crash a server not using tls- auth or tls-crypt by sending a packet with an unexpected payload size. A remote, authenticated attacker can crash a server using an AEAD mode cipher by sending crafted data to exhaust the packet counter. References ========== https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerA... https://ostif.org/the-openvpn-2-4-0-audit-by-ostif-and-quarkslab-results/ http://blog.quarkslab.com/security-assessment-of-openvpn.html https://security.archlinux.org/CVE-2017-7478 https://security.archlinux.org/CVE-2017-7479