PT-2016-7942 · Openvpn · Openvpn

Published 2016-01-12 · Updated 2016-01-12

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenVPN versions prior to 2.3.9

Description The issue is related to an out of bounds read error in the resolve remote() function, located in the socket.c file. This error occurs when handling both IPv4 and IPv6 connections, as OpenVPN reads a struct sockaddr in6 but the data structure is smaller in the IPv4 case.

Recommendations For OpenVPN versions prior to 2.3.9, update to version 2.3.9 to fix this issue and several other bugs.

Related Identifiers

MGASA-2016-0010

Affected Products

Openvpn

References · 5

• https://osv.dev/vulnerability/MGASA-2016-0010 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0010.html · Security Note
• https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.9 · Note
• https://blog.fuzzing-project.org/32-Out-of-bounds-read-in-OpenVPN.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=17418 · Note