PT-2005-1001 · Openvpn · Openvpn

Mike Ireton · Published 2005-08-24 · Updated 2008-09-05 · CVE-2005-2531

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenVPN versions prior to 2.0.1

Description The issue allows remote attackers to cause a denial of service, specifically client disconnection, via a large number of failed authentication attempts. This can happen when OpenVPN is running with "verb 0" and without TLS authentication, causing the error to be processed by the wrong client. The vulnerability can be exploited remotely and may lead to disruption of protected information.

Recommendations For OpenVPN versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider enabling TLS authentication to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-01740

CVE-2005-2531

DSA-851-1

Affected Products

Openvpn

References · 17

• https://osv.dev/vulnerability/DEBIAN-CVE-2005-2531 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-2531 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2533 · Security Note
• https://osv.dev/vulnerability/CVE-2005-2531 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2534 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2005-2531 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2005:145 · Vendor Advisory
• http://debian.org/security/2005/dsa-851 · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_20_sr.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2531 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2532 · Security Note
• https://bdu.fstec.ru/vul/2015-01740 · Security Note
• http://debian.org/security/dsa-851 · Note
• http://openvpn.net/changelog.html · Note
• http://secunia.com/advisories/17103 · Note