The open-source OpenVPN project has pushed out a “moderately critical” update to correct four security flaws that could cause remote denial-of-service attacks.
OpenVPN, the free package available on the Linux, xBSD, Mac OS X and Windows operating systems, has been upgraded to version 2.0.1 to plug the security vulnerabilities.
According to an advisory posted online, the most serious of the four bugs could be exploited by malicious hackers and users to cause a denial-of-service condition.
The first flaw is described as an error in flushing the OpenSSL error queue, caused by a failed client certificate authentication. It can be exploited to cause another unrelated client to be disconnected.
The projects advisory said successful exploitation requires OpenVPN to run with “verb 0” and without “tls-auth.”
A second error in flushing the OpenSSL error queue when the server fails to decrypt a received packet can be exploited by an authenticated client to disconnect another client via a malformed packet.
The group also warned that an authenticated client configured in “dev tap” ethernet bridging mode can flood the server with many packets, each with a different spoofed MAC (media access control) address. This would cause the server to deplete system memory.
When two or more clients connect to the server at the same time using the same client certificate, a fourth flaw causes a race condition that will crash the server, the group warned. Successful exploitation requires that the “duplicate-cn” option not be enabled on the server.
OpenVPN is used to allow peers to authenticate to each other using a preshared private key, certificates or username/password. It uses the OpenSSL encryption library and the SSLv3/TLSv1 protocol.
