PT-2013-1210 · Openvpn+2 · Openvpn+2

Steffan Karger · Published 2013-11-15 · Updated 2020-05-12 · CVE-2013-2061

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenVPN versions prior to 2.3.1

Description The issue allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher. Multiple vulnerabilities in the OpenVPN package can lead to disruption of integrity and availability of protected information, and exploitation can be carried out remotely.

Recommendations For OpenVPN versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the openvpn decrypt function in crypto.c until a patch is available. Avoid using the CBC mode cipher in UDP mode until the issue is resolved.

Exploit

Fix

Improper Certificate Validation

Information Disclosure

Weakness Enumeration

CWE-295

CWE-200

Related Identifiers

ALT-PU-2015-1053

BDU:2015-09682

CVE-2013-2061

SUSE-SU-2013_1783-1

Affected Products

Alt Linux

Openvpn

Suse

References · 16

• 🔥 https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee · Exploit
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00012.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-2061 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2061 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105609.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-2061 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:167 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09682 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00016.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105568.html · Vendor Advisory
• https://bugs.gentoo.org/show_bug.cgi?id=468756 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=960192 · Note
• http://security.gentoo.org/glsa/glsa-201311-13.xml · Note
• https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc · Note