PT-2016-3301 · Openvpn+5 · Openvpn+5

Gaãtan Leurent + 1 · Published 2016-08-24 · Updated 2025-10-21 · CVE-2016-6329

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenVPN versions prior to the fixed version

Description The issue is related to the use of 64-bit block ciphers in OpenVPN, which can be exploited by remote attackers to obtain cleartext data via a birthday attack, specifically a "Sweet32" attack, against long-duration encrypted sessions. This can be demonstrated in an HTTP-over-OpenVPN session using Blowfish in CBC mode.

Recommendations For OpenVPN versions prior to the fixed version, consider disabling the use of 64-bit block ciphers, such as Blowfish in CBC mode, until a patch is available. Restrict access to sensitive data transmitted over OpenVPN to minimize the risk of exploitation. As a temporary workaround, consider using alternative encryption methods that are not affected by the "Sweet32" attack.

Fix

Information Disclosure

Weakness Enumeration

CWE-310

CWE-200

Related Identifiers

ALT-PU-2017-1187

BDU:2019-04216

CVE-2016-6329

MGASA-2016-0304

SUSE-SU-2017:1622-1

SUSE-SU-2017:2838-1

SUSE-SU-2017_1622-1

SUSE-SU-2017_2838-1

USN-3339-1

Affected Products

Alt Linux

Debian

Nessus

Openvpn

Suse

Ubuntu

References · 59

• https://ubuntu.com/security/CVE-2016-6329 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6329 · Vendor Advisory
• https://community.openvpn.net/openvpn/wiki/SWEET32 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3339-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-6329 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/IIPSFOGSRZ5PCY7HRYCDJADE4DTIBMML · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7479 · Security Note
• https://bdu.fstec.ru/vul/2019-04216 · Security Note
• https://security-tracker.debian.org/tracker/source-package/openvpn · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7479 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2838-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3339-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00021 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7521 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-6329 · Security Note