CVE-2017-7478

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/98444
http://www.securitytracker.com/id/1038473
https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits	Vendor Advisory
https://www.exploit-db.com/exploits/41993/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openvpn:openvpn:2.3.12:::::::*
	cpe:2.3:a:openvpn:openvpn:2.3.13:::::::*
	cpe:2.3:a:openvpn:openvpn:2.3.14:::::::*
	cpe:2.3:a:openvpn:openvpn:2.4.0:::::::*
	cpe:2.3:a:openvpn:openvpn:2.4.0:alpha2::::::
	cpe:2.3:a:openvpn:openvpn:2.4.0:beta1::::::
	cpe:2.3:a:openvpn:openvpn:2.4.0:beta2::::::
	cpe:2.3:a:openvpn:openvpn:2.4.0:rc1::::::
	cpe:2.3:a:openvpn:openvpn:2.4.0:rc2::::::
	cpe:2.3:a:openvpn:openvpn:2.4.1:::::::*

History

No history.

Information

Published : 2017-05-15 18:29

Updated : 2023-12-10 12:01

NVD link : CVE-2017-7478

Mitre link : CVE-2017-7478

CVE.ORG link : CVE-2017-7478

JSON object : View

Products Affected

openvpn

openvpn

CWE

CWE-20

Improper Input Validation

CWE-617

Reachable Assertion

{"id": "CVE-2017-7478", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-05-15T18:29:00.293", "references": [{"url": "http://www.securityfocus.com/bid/98444", "source": "secalert@redhat.com"}, {"url": "http://www.securitytracker.com/id/1038473", "source": "secalert@redhat.com"}, {"url": "https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://www.exploit-db.com/exploits/41993/", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2."}, {"lang": "es", "value": "OpenVPN versi\u00f3n 2.3.12 y m\u00e1s recientes, son vulnerables a la Denegaci\u00f3n de Servicio no autenticada del servidor por medio de un paquete de control grande recibido. Tenga en cuenta que este problema se corrige en versiones 2.3.15 y 2.4.2."}], "lastModified": "2017-08-16T01:29:21.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openvpn:openvpn:2.3.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "288EE3C5-C915-4273-B1F1-D53BC028C990"}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.3.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A21C5FE2-2FF7-481F-B128-976EBA563208"}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.3.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF068FA2-03A0-4C7F-97B1-9CB5A49E9E1B"}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84F5C67A-34A4-4C7E-BCA9-AF3E5FC70AF6"}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:alpha2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A857CA88-60B0-4D34-87B6-770B67981501"}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B42297EE-B347-4BD8-A657-BDF0AA010C06"}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C7A56E8-09C8-4DB2-9244-9E5E2BEC1821"}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41ACD637-EF6B-40E4-BDE6-0EE7D6AEBAD4"}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A4150AD-3F46-487D-BCF8-79D0AE2A092D"}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7F7663E-3EB5-44F4-B7DE-294A549A12BE"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}