high7.5Public exploit code
CVE-2017-7478
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- OpenVPN 2.4.0 - Denial of Service2017-05-11 · dos · multiple · Verified
Impact
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openvpn | Openvpn | Versions 2.3.12, 2.3.13, 2.3.14, 2.4.0, 2.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/98444
- http://www.securitytracker.com/id/1038473
- https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits
- https://www.exploit-db.com/exploits/41993/
- http://www.securityfocus.com/bid/98444
- http://www.securitytracker.com/id/1038473
- https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits
- https://www.exploit-db.com/exploits/41993/