[SA19531] OpenVPN LD_PRELOAD Environment Variable Pushing Vulnerability

TITLE: OpenVPN LDPRELOAD Environment Variable Pushing Vulnerability SECUNIA ADVISORY ID: SA19531 VERIFY ADVISORY: http://secunia.com/advisories/19531/ CRITICAL: Less critical IMPACT: System access WHERE: From remote SOFTWARE: OpenVPN 2.x http://secunia.com/product/5568/ DESCRIPTION: Hendrik Weime...

openvpn -- LD_PRELOAD code execution on client through malicious or compromised server

Hendrik Weimer reports: OpenVPN clients are a bit too generous when accepting configuration options from a server. It is possible to transmit environment variables to client-side shell scripts. There are some filters in place to prevent obvious nonsense, however they don't catch the good old...

Mandrake Linux Security Advisory : openvpn (MDKSA-2005:206-1)

Two Denial of Service vulnerabilities exist in OpenVPN. The first allows a malicious or compromised server to execute arbitrary code on the client CVE-2005-3393. The second DoS can occur if when in TCP server mode, OpenVPN received an error on accept2 and the resulting exception handler causes a...

[SECURITY] [DSA 885-1] New OpenVPN packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 885-1 [email protected] http://www.debian.org/security/ Martin Schulze November 7th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 885-1] New OpenVPN packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 885-1 [email protected] http://www.debian.org/security/ Martin Schulze November 7th, 2005 http://www.debian.org/security/faq -...

GLSA-200511-07 : OpenVPN: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200511-07 OpenVPN: Multiple vulnerabilities The OpenVPN client contains a format string bug in the handling of the foreignoption in options.c. Furthermore, when the OpenVPN server runs in TCP mode, it may dereference a NULL pointe...

DSA-885-1 openvpn - several

Bulletin has no description...

OpenVPN: Multiple vulnerabilities

Background OpenVPN is a multi-platform, full-featured SSL VPN solution. Description The OpenVPN client contains a format string bug in the handling of the foreignoption in options.c. Furthermore, when the OpenVPN server runs in TCP mode, it may dereference a NULL pointer under specific error...

CVE-2005-3409

OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service segmentation fault by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler...

CVE-2005-3409

OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service segmentation fault by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler...

CVE-2005-3409

OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service segmentation fault by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler...

DEBIAN-CVE-2005-3409

OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service segmentation fault by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler...

CVE-2005-3409

OpenVPN 2.x is affected by CVE-2005-3409 (pre-2.0.4). The issue is a denial-of-service caused by forcing accept() to return an error, which leads to a NULL pointer dereference in the exception handler, potentially crashing the service. The vulnerability affects OpenVPN servers operating in TCP mo...

CVE-2005-3409

OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service segmentation fault by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler...

CVE-2005-3409

OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service segmentation fault by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler...

CVE-2005-3393

Format string vulnerability in the foreignoption function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option...

CVE-2005-3393

Format string vulnerability in the foreignoption function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option...

DEBIAN-CVE-2005-3393

Format string vulnerability in the foreignoption function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option...

CVE-2005-3393

Format string vulnerability in the foreignoption function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option...

CVE-2005-3393

OpenVPN 2.0.x is affected by CVE-2005-3393 due to a format-string vulnerability in the foreign_option function (options.c) used when pushing dhcp-option. This could allow a remote attacker to execute arbitrary code on non-Windows OpenVPN clients during TLS negotiation if the server/client configu...