PT-2008-4861 · Openvpn · Openvpn

Published 2008-08-04 · Updated 2017-08-08 · CVE-2008-3459

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.1-beta14 through 2.1-rc8

Description The issue allows remote servers to execute arbitrary commands via crafted configuration directives, specifically lladdr and iproute, likely due to shell metacharacters. This problem occurs when OpenVPN is running on non-Windows systems.

Recommendations For OpenVPN versions 2.1-beta14 through 2.1-rc8, consider restricting access to the lladdr and iproute configuration directives to minimize the risk of exploitation. As a temporary workaround, avoid using these directives until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2008-3459

Affected Products

Openvpn

References · 9

• https://security-tracker.debian.org/tracker/CVE-2008-3459 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3459 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-3459 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-3459 · Vendor Advisory
• http://vupen.com/english/advisories/2008/2316 · Vendor Advisory
• http://securitytracker.com/id?1020626 · Note
• http://openvpn.net/index.php/documentation/change-log/changelog-21.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44209 · Note
• http://securityfocus.com/bid/30532 · Note