PT-2024-6141 · Openvpn+1 · Openvpn+1
Vladimir Tokarev
·
Published
2024-03-24
·
Updated
2024-08-23
·
CVE-2024-27459
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenVPN versions 2.6.9 and earlier
Description
The issue is related to the interactive service in OpenVPN, which allows an attacker to send data causing a stack overflow. This can be used to execute arbitrary code with more privileges. The vulnerability is also described as being related to insufficient restriction of the communication channel for given endpoints, which can allow a remote attacker to elevate their privileges and execute arbitrary code.
Recommendations
For OpenVPN versions 2.6.9 and earlier, consider disabling the interactive service as a temporary workaround until a patch is available. Restrict access to the vulnerable service to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Memory Corruption
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Openvpn