PT-2005-1002 · Openvpn · Openvpn

Mike Ireton · Published 2005-08-24 · Updated 2008-09-05 · CVE-2005-2532

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenVPN versions prior to 2.0.1

Description The issue allows remote authenticated attackers to cause a denial of service, specifically client disconnection, by sending a large number of packets that cannot be decrypted. This is due to OpenVPN's failure to properly flush the OpenSSL error queue when a packet cannot be decrypted by the server. Multiple vulnerabilities in the OpenVPN package may lead to disruption of protected information availability, and exploitation can be carried out remotely.

Recommendations For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the number of undecryptable packets that can be sent to the server to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-01740

CVE-2005-2532

DSA-851-1

Affected Products

Openvpn

References · 16

• https://security-tracker.debian.org/tracker/CVE-2005-2532 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2533 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2534 · Security Note
• https://osv.dev/vulnerability/CVE-2005-2532 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:145 · Vendor Advisory
• http://debian.org/security/2005/dsa-851 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-2532 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2531 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2005-2532 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2532 · Security Note
• https://bdu.fstec.ru/vul/2015-01740 · Security Note
• http://debian.org/security/dsa-851 · Note
• http://securityfocus.com/bid/14607 · Note
• http://openvpn.net/changelog.html · Note
• http://secunia.com/advisories/17103 · Note