PT-2024-5009 · Openvpn+1 · Openvpn+1

Vladimir Tokarev · Published 2024-03-20 · Updated 2024-08-14 · CVE-2024-27903

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OpenVPN versions 2.6.9 and earlier

Description: The issue is related to the unrestricted loading of plug-in files in OpenVPN on Windows. This allows an attacker to load an arbitrary plug-in, which can interact with the privileged OpenVPN interactive service.

Recommendations: For OpenVPN versions 2.6.9 and earlier, consider disabling the plug-in loading feature until a patch is available. Restrict access to the OpenVPN interactive service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Unrestricted File Upload

Weakness Enumeration

CWE-923

CWE-787

CWE-434

CWE-283

Related Identifiers

ALT-PU-2024-10859

ALT-PU-2024-10885

ALT-PU-2024-4639

BDU:2024-05533

BDU:2024-07059

BDU:2024-07060

CVE-2024-27903

Affected Products

Alt Linux

Openvpn

References · 19

• https://community.openvpn.net/openvpn/wiki/CVE-2024-27903 · Vendor Advisory
• https://openvpn.net/security-advisory/ovpnx-vulnerability-cve-2024-27903-cve-2024-27459-cve-2024-24974 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27903 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07059 · Security Note
• https://bdu.fstec.ru/vul/2024-07060 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-27459 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05533 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-27903 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-24974 · Vendor Advisory
• https://t.me/echeloneyes/3044 · Telegram Post
• https://twitter.com/fletch_ai/status/1772464619665187116 · Twitter Post
• https://twitter.com/CVEnew/status/1810261069107015852 · Twitter Post
• https://altsp.su/obnovleniya-bezopasnosti · Note
• https://mail-archive.com/[e-mail]/msg07534.html · Note
• https://t.me/true_secator/6083 · Telegram Post