PT-2018-18991 · Openvpn+2 · Openvpn+2

Jacob Baines · Publicado 2018-05-01 · Atualizado 2024-06-15 · CVE-2018-9336

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.4.0 through 2.4.5

Description The issue allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service, potentially leading to a denial-of-service through memory corruption or possibly having unspecified other impact, including privilege escalation.

Recommendations For OpenVPN versions 2.4.0 through 2.4.5, update to version 2.4.6 or later to resolve the issue.

Exploit

Correção

DoS

Double Free

Enumeração de Fraquezas

CWE-415

Identificadores relacionados

ALT-PU-2018-1644

CVE-2018-9336

MGASA-2018-0329

OPENSUSE-SU-2018_1912-1

OPENSUSE-SU-2024:11128-1

SUSE-SU-2018:1888-1

SUSE-SU-2018_1888-1

Produtos afetados

Alt Linux

Openvpn

Suse

Referências · 36

• 🔥 https://tenable.com/security/research/tra-2018-09 · Exploit
• https://github.com/OpenVPN/openvpn/releases/tag/v2.4.6 · Nota
• https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79b · Correção
• https://advisories.mageia.org/MGASA-2018-0329.html · Nota de Segurança
• https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24 · Aviso do Fabricante
• https://bugzilla.suse.com/1090839 · Nota
• https://suse.com/security/cve/CVE-2017-7522 · Nota
• https://suse.com/security/cve/CVE-2005-3409 · Nota
• https://suse.com/security/cve/CVE-2018-9336.html · Nota
• http://lists.suse.com/pipermail/sle-security-updates/2018-July/004246.html · Nota
• https://osv.dev/vulnerability/MGASA-2018-0329 · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2018-9336 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/KI5UELBIST2AJ4OLUEACEQQXI3QHMZAR · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9336 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2018:1888-1 · Aviso do Fabricante