PT-2023-6378 · Openvpn · Openvpn Connect

Mr. Ka Lok Wu · Publicado 2023-10-17 · Atualizado 2023-10-24 · CVE-2022-3761

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenVPN Connect versions before 3.4.0.4506 (macOS) OpenVPN Connect versions before 3.4.0.3100 (Windows)

Description The issue is related to errors in the certificate authentication procedure, allowing a remote attacker to perform a man-in-the-middle attack. This can lead to the interception of configuration profile download requests, which may contain user credentials.

Recommendations For OpenVPN Connect versions before 3.4.0.4506 (macOS), update to version 3.4.0.4506 or later. For OpenVPN Connect versions before 3.4.0.3100 (Windows), update to version 3.4.0.3100 or later. As a temporary workaround, consider restricting access to sensitive configuration profiles until a patch is applied.

Correção

Improper Authentication

Improper Certificate Validation

Enumeração de Fraquezas

CWE-287

CWE-295

Identificadores relacionados

BDU:2023-07090

CVE-2022-3761

Produtos afetados

Openvpn Connect

Referências · 8

• https://t.me/cibsecurity/72420 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-07090 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-3761 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1714257453590974674 · Publicação no Twitter
• https://twitter.com/DMFezzaReedCISA/status/1714284059306901858 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2022-3761 · Nota de Segurança
• https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log · Nota
• https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log · Nota