PT-2005-1002 · Openvpn · Openvpn

Mike Ireton · Publicado 2005-08-24 · Atualizado 2008-09-05 · CVE-2005-2532

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenVPN versions prior to 2.0.1

Description The issue allows remote authenticated attackers to cause a denial of service, specifically client disconnection, by sending a large number of packets that cannot be decrypted. This is due to OpenVPN's failure to properly flush the OpenSSL error queue when a packet cannot be decrypted by the server. Multiple vulnerabilities in the OpenVPN package may lead to disruption of protected information availability, and exploitation can be carried out remotely.

Recommendations For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the number of undecryptable packets that can be sent to the server to minimize the risk of exploitation.

Correção

Identificadores relacionados

BDU:2015-01740

CVE-2005-2532

DSA-851-1

Produtos afetados

Openvpn

Referências · 16

• https://security-tracker.debian.org/tracker/CVE-2005-2532 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2533 · Nota de Segurança
• http://debian.org/security/dsa-851 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2534 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2005-2532 · Aviso do Fabricante
• http://securityfocus.com/bid/14607 · Nota
• http://openvpn.net/changelog.html · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2005:145 · Aviso do Fabricante
• http://debian.org/security/2005/dsa-851 · Aviso do Fabricante
• http://secunia.com/advisories/17103 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-2532 · Aviso do Fabricante
• http://secunia.com/advisories/16463 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2531 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2005-2532 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2532 · Nota de Segurança