Multiple OpenVPN DoS conditions

Problem with OpenSSL errors handing, memory exhaustion, race conditions...

openvpn -- multiple TCP clients connecting with the same certificate at the same time can crash the server

James Yonan reports: If two or more client machines try to connect to the server at the same time via TCP, using the same client certificate, and when --duplicate-cn is not enabled on the server, a race condition can crash the server with "Assertion failed at mtcp.c:411"...

openvpn -- denial of service: client certificate validation can disconnect unrelated clients

James Yonan reports: DoS attack against server when run with "verb 0" and without "tls-auth". If a client connection to the server fails certificate verification, the OpenSSL error queue is not properly flushed, which can result in another unrelated client instance on the server seeing the error...

openvpn -- denial of service: undecryptable packet from authorized client can disconnect unrelated clients

James Yonan reports: If the client sends a packet which fails to decrypt on the server, the OpenSSL error queue is not properly flushed, which can result in another unrelated client instance on the server seeing the error and responding to it, resulting in disconnection of the unrelated client...

openvpn -- denial of service: malicious authenticated "tap" client can deplete server virtual memory

James Yonan reports: A malicious authenticated client in "dev tap" ethernet bridging mode could theoretically flood the server with packets appearing to come from hundreds of thousands of different MAC addresses, causing the OpenVPN process to deplete system virtual memory as it expands its...

PT-2009-6739

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 0.9.8l GnuTLS versions prior to 2.8.5 Apache HTTP Server versions prior to 2.2.14 Microsoft Internet Information Services IIS 7.0 OpenVPN versions prior to 2.3.1 Mozilla Network Security Services NSS versions prior to...