PT-2020-2060 · Openvpn+5 · Openvpn+5
Lev Stipakov
·
Published
2020-04-17
·
Updated
2024-06-15
·
CVE-2020-11810
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
OpenVPN versions 2.4.x through 2.4.8
Description
An issue was discovered in OpenVPN where an attacker can inject a data channel v2 (P DATA V2) packet using a victim's peer-id. Normally such packets are dropped, but if this packet arrives before the data channel crypto parameters have been initialized, the victim's connection will be dropped. This requires careful timing due to the small time window (usually within a few seconds) between the victim client connection starting and the server PUSH REPLY response back to the client. This attack will only work if Negotiable Cipher Parameters (NCP) is in use. The vulnerability can be exploited to redirect a client session to a new IP address and cause a denial of service.
Recommendations
For OpenVPN versions 2.4.x through 2.4.8, update to version 2.4.9 to resolve the issue. As a temporary workaround, consider disabling Negotiable Cipher Parameters (NCP) until a patch is available. Restrict access to the vulnerable data channel v2 (P DATA V2) packet to minimize the risk of exploitation. Avoid using the peer-id parameter in the affected API endpoint until the issue is resolved.
Exploit
Fix
Race Condition
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Openvpn
Suse
Ubuntu