CERT-In Vulnerability Note
CIVN-2023-0346
Multiple Vulnerabilities in OpenVPN Access Server
Original Issue Date:November 22, 2023
Severity Rating: HIGH
Software Affected
- OpenVPN Access Server versions prior to 2.12.2
Overview
Multiple vulnerabilities have been reported in OpenVPN Access Server which could be exploited by an attacker to execute remote code and cause denial of service on the targeted system.
Description
1. Denial of service vulnerability
(
CVE-2023-46849
)
This vulnerability exists in OpenVPN Access Server due to a divide by zero flaw. A remote attacker could exploit this vulnerability by using the --fragment option in certain configuration setups. Successful exploitation of this vulnerability could allow the attacker to cause denial of service conditions on the targeted system.
2. Information Disclosure vulnerability
(
CVE-2023-46850
)
This vulnerability exists in OpenVPN Access Server due to use-after-free flaw. An attacker could exploit this vulnerability by sending specially crafted network buffers to a remote peer resulting in leaking memory buffers.
Successful exploitation of this vulnerability could allow the attacker to conduct further attacks such as remote code execution on the targeted system.
Solution
Apply appropriate updates as mentioned:
https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/
Vendor Information
https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/
References
https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/
CVE Name
CVE-2023-46849
CVE-2023-46850
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|