OpenVPN 2.7.0_beta3 < 2.7.0_I017 Buffer Overflow (Windows)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(300078);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/02");

  script_cve_id("CVE-2026-2738");
  script_xref(name:"IAVA", value:"2026-A-0176");

  script_name(english:"OpenVPN 2.7.0_beta3 < 2.7.0_I017 Buffer Overflow (Windows)");

  script_set_attribute(attribute:"synopsis", value:
"An application on the remote Windows host is affected by buffer overflow vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the version of OpenVPN installed on the remote Windows host is affected
by buffer overflow vulnerability: 

- The ovpn-dco-win version 2.8.0 has a flaw which appears when connecting to an OpenVPN 2.7.0 server, or 
    other implementations with data epoch keys support. This moved the AEAD tag towards the end of the 
    encrypted packet. In the ovpn-dco-win version 2.8.0, the calculated buffer length did not account for 
    the needed buffer overhead to add the AEAD tag, which resulted in a buffer overflow. The ovpn-dco-win 
    version 2.8.0 was shipped with OpenVPN version 2.7_beta3 through 2.7.0_I016. The OpenVPN 2.7.0_I017 
    Windows installer provides ovpn-dco-win version 2.8.2 which resolves this issue. (CVE-2026-2738)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://community.openvpn.net/Security%20Announcements/CVE-2026-2738
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8ee1b4b7");
  # https://community.openvpn.net/Downloads#openvpn-270-released-11-february-2026
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?883976b6");
  script_set_attribute(attribute:"solution", value:
"See vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-2738");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:openvpn:openvpn");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("openvpn_server_installed.nbin");
  script_require_keys("installed_sw/OpenVPN Server");

  exit(0);
}


include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}},
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'OpenVPN Server', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        { 'equal' : '2.7.0', 'fixed_display' : 'See vendor advisory' }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);