OpenVPN vulnerabilities

An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options.

OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field.

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. This issue is fixed in 2.3.15 and 2.4.2.

The Windows interactive service in OpenVPN (versions 2.7_alpha1 through 2.7.4) allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during disconnection.

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses.

OpenVPN versions 2.6.0 to 2.6.6 contain a use after free vulnerability that may lead to undefined behavior, leaking memory buffers, or remote code execution when sending network buffers to a remote peer.

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.

In OpenVPN through 2.6.22 and 2.7.6, retransmissions of ACK packet ID allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow.

An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject. The vulnerability affects the Windows platform.

OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps.

OpenVPN versions 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects.

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation.

OpenVPN versions 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries.

An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs.

The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths.

OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field.

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks.

In OpenVPN (versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4), an incomplete guard allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to denial of service or memory leakage.

In OpenVPN (versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4), a use-after-free allows remote authenticated peers to potentially cause denial of service or memory leakage via crafted packets during TLS session promotion or expiry.

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets.

A vulnerability in OpenVPN versions 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers to exploit an off-by-one buffer write in NTLM proxy authentication, potentially causing a crash via a crafted NTLM response from a malicious proxy server.

A vulnerability in OpenVPN versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows a remote attacker to cause a denial of service by sending a malformed authentication token when external-auth is enabled. The issue is due to a reachable assertion in the code.

A memory leak vulnerability in OpenVPN versions 2.5.0–2.5.11, 2.6.0–2.6.20, and 2.7_alpha1–2.7.4 allows a remote attacker with a valid tls-crypt-v2 client key to cause a denial of service (DoS).

A race condition in OpenVPN versions 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 leads to a use-after-free vulnerability during TLS session promotion. Remote attackers can exploit this to cause a server crash or leak heap memory.

In OpenVPN versions 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1, improper validation of packet length during tls-crypt-v2 key extraction allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client.