PT-2008-4861 · Openvpn · Openvpn

Publicado 2008-08-04 · Atualizado 2017-08-08 · CVE-2008-3459

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.1-beta14 through 2.1-rc8

Description The issue allows remote servers to execute arbitrary commands via crafted configuration directives, specifically lladdr and iproute, likely due to shell metacharacters. This problem occurs when OpenVPN is running on non-Windows systems.

Recommendations For OpenVPN versions 2.1-beta14 through 2.1-rc8, consider restricting access to the lladdr and iproute configuration directives to minimize the risk of exploitation. As a temporary workaround, avoid using these directives until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2008-3459

Produtos afetados

Openvpn

Referências · 9

• https://security-tracker.debian.org/tracker/CVE-2008-3459 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-3459 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-3459 · Aviso do Fabricante
• http://securitytracker.com/id?1020626 · Nota
• http://openvpn.net/index.php/documentation/change-log/changelog-21.html · Nota
• https://osv.dev/vulnerability/CVE-2008-3459 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44209 · Nota
• http://vupen.com/english/advisories/2008/2316 · Aviso do Fabricante
• http://securityfocus.com/bid/30532 · Nota