PT-2024-1066 · Openvpn · Openvpn Connect

Fatih + 1 · Published 2024-01-08 · Updated 2024-09-04 · CVE-2023-7224

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenVPN Connect versions 3.0 through 3.4.6

Description The issue is related to the failure to neutralize instructions in dynamically executed code. Exploitation of this issue may allow an attacker to execute arbitrary code using the DYLD INSERT LIBRARIES environment variable. This can enable local users to execute code in external third-party libraries.

Recommendations For OpenVPN Connect versions 3.0 through 3.4.6, update to a version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting the use of the DYLD INSERT LIBRARIES environment variable until a patch is available.

Fix

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

BDU:2024-00298

CVE-2023-7224

Affected Products

Openvpn Connect

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-7224 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7224 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00298 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-7224 · Security Note
• https://t.me/cvenotify/66615 · Telegram Post
• https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log · Note
• https://twitter.com/cracbot/status/1745899724383871230 · Twitter Post
• https://t.me/cvenotify/66597 · Telegram Post
• https://twitter.com/FeCassie/status/1772189247765729454 · Twitter Post