Title: OpenVPN Client Remote Format String Vulnerability
Severity: HIGH
Description:
OpenVPN is an OpenSSL based tunneling application to securely tunnel IP networks over the TCP and UDP protocols.
OpenVPN is reported prone to a remote format string vulnerability. This issue results from insufficient sanitization of user-supplied data.
This issue arises in the 'foreign_option()' function of the 'options.c' file. User-supplied input from a server is not sanitized prior to passing it as the format specifier to a formatted printing function called 'buf_printf()'. Specifically, a malicious server can send command options such as 'dhcp-option' including format specifiers to a client to trigger this vulnerability.
A remote attacker may leverage this issue to write to arbitrary process memory, facilitating code execution. This can result in unauthorized remote access.
This issue affects OpenVPN 2.0.x versions. OpenVPN running on Windows is not vulnerable to this issue.
Affected Products:
- Debian Linux 3.1.0
- Debian Linux 3.1.0 alpha
- Debian Linux 3.1.0 amd64
- Debian Linux 3.1.0 arm
- Debian Linux 3.1.0 hppa
- Debian Linux 3.1.0 ia-32
- Debian Linux 3.1.0 ia-64
- Debian Linux 3.1.0 m68k
- Debian Linux 3.1.0 mips
- Debian Linux 3.1.0 mipsel
- Debian Linux 3.1.0 ppc
- Debian Linux 3.1.0 s/390
- Debian Linux 3.1.0 sparc
- Gentoo Linux
- MandrakeSoft Corporate Server 3.0.0
- MandrakeSoft Linux Mandrake 2006.0.0
- MandrakeSoft Linux Mandrake 2006.0.0 x86_64
- MandrakeSoft Multi Network Firewall 2.0.0
- OpenPKG OpenPKG 2.3.0
- OpenPKG OpenPKG 2.4.0
- OpenPKG OpenPKG 2.5.0
- OpenPKG OpenPKG Current
- OpenVPN OpenVPN 2.0.0
- OpenVPN OpenVPN 2.0.0 beta11
- OpenVPN OpenVPN 2.0.1
- OpenVPN OpenVPN 2.0.2
- S.u.S.E. Linux Personal 10.0.0 OSS
- S.u.S.E. Linux Personal 9.3.0
- S.u.S.E. Linux Personal 9.3.0 x86_64
- S.u.S.E. Linux Professional 10.0.0
- S.u.S.E. Linux Professional 10.0.0 OSS
- S.u.S.E. Linux Professional 9.3.0
- S.u.S.E. Linux Professional 9.3.0 x86_64
References:
- OpenVPN: OpenVPN Change Log
- OpenVPN: OpenVPN Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
