PT-2017-17762 · Openvpn+3 · Openvpn+3

Guido Vranken · Publicado 2017-05-11 · Atualizado 2019-10-03 · CVE-2017-7479

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenVPN versions prior to 2.3.15 OpenVPN versions prior to 2.4.2

Description The issue allows an authenticated attacker to cause a Denial of Service of the server. This occurs when the packet-ID counter rolls over, resulting in a reachable assertion.

Recommendations For versions prior to 2.3.15, update to version 2.3.15 or later. For versions prior to 2.4.2, update to version 2.4.2 or later.

Correção

DoS

Assertion Failure

Enumeração de Fraquezas

CWE-617

Identificadores relacionados

ALT-PU-2017-1606

CVE-2017-7479

DLA-944-1

DSA-3900-1

MGASA-2017-0152

SUSE-SU-2017:1622-1

SUSE-SU-2017:1718-1

SUSE-SU-2017:2838-1

USN-3284-1

USN-3339-1

Produtos afetados

Alt Linux

Openvpn

Suse

Ubuntu

Referências · 61

• http://debian.org/security/2017/dsa-3900 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-7478 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00021 · Nota de Segurança
• https://suse.com/support/update/announcement/2017/suse-su-20172838-1 · Nota
• https://ubuntu.com/security/notices/USN-3339-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1060877 · Nota
• https://suse.com/security/cve/CVE-2017-7521 · Nota
• https://ubuntu.com/security/CVE-2017-7521 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7521 · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-6329 · Nota
• https://suse.com/security/cve/CVE-2017-12166 · Nota
• https://packages.debian.org/src:openvpn · Nota
• https://osv.dev/vulnerability/SUSE-SU-2017:1718-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/openvpn · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7520 · Nota de Segurança