CVE-2017-7479

2017-05-1100:00:00

ubuntu.com

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

0.004 Low

EPSS

Percentile

72.7%

JSON

OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable
assertion when packet-ID counter rolls over resulting into Denial of
Service of server by authenticated attacker.

Bugs

<https://launchpad.net/bugs/1691531>

Notes

Author	Note
sbeattie	fix needs a87e1431baccd49a9344cfc63ab7446c4317fa2f (2.4) or 5d747770efa0611cc6cfeb6b3a5853bf51046d53 (2.3) as a prequisite

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchopenvpn< 2.3.2-7ubuntu3.2UNKNOWN
ubuntu16.04noarchopenvpn< 2.3.10-1ubuntu2.1UNKNOWN
ubuntu16.10noarchopenvpn< 2.3.11-1ubuntu2.1UNKNOWN
ubuntu17.04noarchopenvpn< 2.4.0-4ubuntu1.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	openvpn	< 2.3.2-7ubuntu3.2	UNKNOWN
ubuntu	16.04	noarch	openvpn	< 2.3.10-1ubuntu2.1	UNKNOWN
ubuntu	16.10	noarch	openvpn	< 2.3.11-1ubuntu2.1	UNKNOWN
ubuntu	17.04	noarch	openvpn	< 2.4.0-4ubuntu1.2	UNKNOWN