CVE-2020-8953

OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass except when a user is enrolled in two-factor authentication...

CVE-2020-8953

OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass except when a user is enrolled in two-factor authentication...

CVE-2020-8953

CVE-2020-8953 affects OpenVPN Access Server 2.8.x prior to 2.8.1, where an LDAP authentication bypass is possible unless the user is enrolled in two-factor authentication. The description explicitly identifies the affected product/version and the root cause as an LDAP authentication bypass, enabl...

Inferring and hijacking VPN-tunneled TCP connections

We have discovered a vulnerability in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android which allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and...

PT-2020-20391

Name of the Vulnerable Software and Affected Versions OpenVPN Access Server versions 2.8.0 through 2.8.0 Description The issue allows LDAP authentication bypass, except when a user is enrolled in two-factor authentication. Recommendations For OpenVPN Access Server versions 2.8.0 through 2.8.0,...

CVE-2020-8953: Improper Authentication

OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass except when a user is enrolled in two-factor authentication...

OpenVPN Memory Corruption Vulnerability

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. freeBSD is a Unix-like operating system from the Google Foundation and the Open Handheld Alliance OHA. pts is a pseudo-terminal driver used in it. OpenBSD is a cross-platform, BSD-based, UNIX-lik...

CVE-2020-5180

Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the memory of the OpenVPN process, leading to limited local privilege escalation. When a VPN connection is initiated using a TLS/SSL client...

CVE-2020-5180

Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the memory of the OpenVPN process, leading to limited local privilege escalation. When a VPN connection is initiated using a TLS/SSL client...

Design/Logic Flaw

Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the memory of the OpenVPN process, leading to limited local privilege escalation. When a VPN connection is initiated using a TLS/SSL client...

CVE-2020-5180

Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the memory of the OpenVPN process, leading to limited local privilege escalation. When a VPN connection is initiated using a TLS/SSL client...

CVE-2020-5180

Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the memory of the OpenVPN process, leading to limited local privilege escalation. When a VPN connection is initiated using a TLS/SSL client...

CVE-2020-5180

CVE-2020-5180 affects Viscosity 1.8.2 on Windows and macOS. An unprivileged user can set a subset of OpenVPN parameters, enabling loading of a malicious library into the memory of the OpenVPN process and causing limited local privilege escalation. When a VPN connection starts with a TLS/SSL clien...

PT-2020-18286

Name of the Vulnerable Software and Affected Versions Viscosity version 1.8.2 Description The issue allows an unprivileged user to set certain OpenVPN parameters, potentially loading a malicious library into the OpenVPN process memory. This can lead to limited local privilege escalation. When a V...

CVE-2020-5180: Undefined Security Weakness

Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the memory of the OpenVPN process, leading to limited local privilege escalation. When a VPN connection is initiated using a TLS/SSL client...

Nord Security: Race condition (TOCTOU) in NordVPN can result in local privilege escalation

Summary: A vulnerability exists in the NordVPN service, which is installed as part of the NordVPN Windows app. By exploiting a race condition in the NordVPN service it is possible to launch OpenVPN with a user-supplied configuration file. By setting an OpenSSL engine name within this configuratio...

Nord Security: Potential leak of server side software at repogohi.nordvpn.com

Summary: I found a public Git Repository at https://repogohi.nordvpn.com/. It looks like the software components in this repository are part of the VPN Servers. So I'm afraid there's a certain risk. The following packages are among others publicly available: openvpn-xor2.4.5-stretch1nordamd64.deb...

CVE-2019-14899

A flaw was found in openvpn. A malicous access point or adjacent user can determine if a connected user is using a VPN by making positive inferences about the websites they are visiting, and determining the correct sequence and acknowledgement numbers in use, which allows the attacker to inject...

Linux Bug Opens Most VPNs to Hijacking

A vulnerability in most Linux distros has been uncovered that allows a network-adjacent attacker to hijack VPN connections and inject rogue data into the secure tunnels that victims are using to communicate with remote servers. According to researchers at University of New Mexico and Breakpointin...

New Linux Bug Lets Attackers Hijack Encrypted VPN Connections

A team of cybersecurity researchers has disclosed a new severe vulnerability affecting most Linux and Unix-like operating systems, including FreeBSD, OpenBSD, macOS, iOS, and Android, that could allow remote 'network adjacent attackers' to spy on and tamper with encrypted VPN connections. The...