OpenVPN Unauthenticated Denial of Service Vulnerability

OpenVPN is a software package for creating virtual private network VPN encrypted tunnels from the American company OpenVPN.OpenVPN PrivateTunnel is an OpenVPN service. A denial-of-service vulnerability exists in OpenVPN that allows remote attackers to conduct denial-of-service attacks by submitti...

OpenVPN Denial of Service Vulnerability (CNVD-2017-06937)

OpenVPN is a software package from the American company OpenVPN for creating encrypted tunnels for Virtual Private Networks VPNs, which uses the OpenSSL library to encrypt data and control information, and allows created VPNs to be authenticated using public keys, electronic certificates, or...

Debian DLA-944-1 : openvpn security update

Denial of Service due to Exhaustion of Packet-ID counter An authenticated client can cause the server's the packet-id counter to roll over, which would lead the server process to hit an ASSERT and stop running. To make the server hit the ASSERT, the client must first cause the server to send it...

[SECURITY] [DLA 944-1] openvpn security update

Package : openvpn Version : 2.2.1-8+deb7u4 CVE ID : CVE-2017-7479 Denial of Service due to Exhaustion of Packet-ID counter An authenticated client can cause the servers the packet-id counter to roll over, which would lead the server process to hit an ASSERT and stop running. To make the server hi...

Fedora 25 : openvpn (2017-0d0f18140a)

This update brings in the latest OpenVPN v2.4.2 release. This release contains fixes for two authenticated remote DoS vulnerabilities CVE-2017-7478 and CVE-2017-7479. For more information see the upstream security announcement. Note that Tenable Network Security has extracted the preceding...

DLA-944-1 openvpn - security update

Bulletin has no description...

Authentication flaw

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker...

Design/Logic Flaw

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2...

CVE-2017-7478

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2...

CVE-2017-7479

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker...

CVE-2017-7478

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2...

ALPINE-CVE-2017-7479

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker...

ALPINE-CVE-2017-7478

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2...

CVE-2017-7479

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker...

DEBIAN-CVE-2017-7479

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker...

EUVD-2017-16499

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2...

CVE-2017-7479

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker...

CVE-2017-7478

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2...

CVE-2017-7478

CVE-2017-7478 affects OpenVPN 2.3.12 and later: an unauthenticated attacker can trigger a denial-of-service by sending an oversized P_CONTROL payload, causing the server to terminate. The issue is fixed in OpenVPN 2.3.15 and 2.4.2. mitigations include tls-auth/tls-crypt protection; advisories ind...

CVE-2017-7479

OpenVPN is affected: versions before 2.3.15 and before 2.4.2 fail to correctly handle rollover of the packet-ID counter, enabling an authenticated attacker to cause a denial-of-service via application crash. Root cause is improper handling of packet-ID rollover. The issue is mitigated by upgradin...