PT-2017-3265 · Openvpn+3 · Openvpn+3

Published 2017-06-06 · Updated 2019-10-03 · CVE-2017-7520

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenVPN versions prior to 2.4.3 OpenVPN versions prior to 2.3.17

Description The issue is related to the improper handling of client connections to HTTP proxies with NTLMv2 authentication. It may allow a remote attacker to execute arbitrary code. The vulnerability can also be triggered by a man-in-the-middle attacker, potentially leading to denial-of-service and/or sensitive memory leaks.

Recommendations For versions prior to 2.4.3, update to version 2.4.3 or later. For versions prior to 2.3.17, update to version 2.3.17 or later. As a temporary workaround, consider restricting access to HTTP proxies with NTLMv2 authentication until a patch is applied.

Fix

DoS

Information Disclosure

Improper Certificate Validation

Out of bounds Read

Weakness Enumeration

CWE-200

CWE-295

CWE-125

Related Identifiers

ALT-PU-2017-1766

BDU:2018-00021

CVE-2017-7520

DLA-999-1

DSA-3900-1

MGASA-2017-0224

OPENSUSE-SU-2017_1680-1

SUSE-SU-2017:1635-1

SUSE-SU-2017:1718-1

USN-3339-1

USN-3339-2

Affected Products

Alt Linux

Openvpn

Suse

Ubuntu

References · 57

• http://debian.org/security/2017/dsa-3900 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00021 · Security Note
• https://ubuntu.com/security/notices/USN-3339-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7520 · Security Note
• https://ubuntu.com/security/CVE-2017-7521 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7521 · Security Note
• https://ubuntu.com/security/notices/USN-3339-2 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1718-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/openvpn · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7520 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7522 · Security Note
• https://osv.dev/vulnerability/USN-3339-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7508 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3900-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7520 · Vendor Advisory