Your OpenVPN server might be at risk

[bigcat]

In late November 2014 Dragana Damjanovic notified OpenVPN developers of a critical denial of service security vulnerability (CVE-2014-8104). The vulnerability allows a tls-authenticated client to crash the server by sending a too-short control channel packet to the server. In other words this vulnerability is denial of service only.

A fixed version of OpenVPN (2.3.6) was released 1st Dec 2014 at around 18:00 UTC. The fix was also backported to the OpenVPN 2.2 branch and released in OpenVPN 2.2.3, a source-only release.

An OpenVPN server can be easily exploited (crashed) using this vulnerability by an authenticated client

How to fix?

Simply install a patched version of OpenVPN. If you're using official releases then, go for OpenVPN 2.3.6 or latest Git "master". If you're using OpenVPN from your operating system's software repositories then install an updated version from them.

https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b

 

[HalfEatenPie]

Hm interesting news. 

Any information if they're going to update the repos?  

 

[SentinelTower]

It seems that the debian repo has been updated for wheezy (security):

https://security-tracker.debian.org/tracker/CVE-2014-8104

 

[rds100]

The key here is "by authenticated client". I.e. your personal private OpenVPN server is not at risk.

 

[D. Strout]

The key here is "by authenticated client". I.e. your personal private OpenVPN server is not at risk.

Good to know.