#30529 – CVE-2014-8104 Critical denial of service vulnerability in OpenVPN servers

Bug 30529 - CVE-2014-8104 Critical denial of service vulnerability in OpenVPN servers

Summary: CVE-2014-8104 Critical denial of service vulnerability in OpenVPN servers

Status:	CLOSED FIXED

Alias:	None

Product:	Sisyphus
Classification:	Development
Component:	openvpn (show other bugs)
Version:	unstable
Hardware:	all Linux

Importance:	P3 normal
Assignee:	Nikolay A. Fetisov
QA Contact:	qa-sisyphus

URL:	https://security-tracker.debian.org/t...
Keywords:	security

Depends on:
Blocks:

Reported:	2014-12-02 14:24 MSK by Mike Lykov
Modified:	2015-01-17 16:28 MSK (History)
CC List:	3 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description

Mike Lykov 2014-12-02 14:24:57 MSK

Dragana Damjanovic discovered that an authenticated client could crash
an OpenVPN server by sending a control packet containing less than
four bytes as payload.

удаленное использование ошибки возможно для вызова падения сервера, надо бы версию обновить (а то Built: almost 3 years ago)

Comment 1

Michael Shigorin 2014-12-03 13:09:20 MSK

Как вариант, задокументировать реализацию gear-репозитория с переносом апстримных исходников в подкаталог -- вчера сходу не сообразил.

Comment 2

Anton Farygin 2015-01-15 17:45:05 MSK

ping мейнтейнер ?

Comment 3

Michael Shigorin 2015-01-15 21:27:58 MSK

См. тж. bug #30319

Comment 4

Nikolay A. Fetisov 2015-01-15 21:37:51 MSK

До OpenVPN добрался, сегодня обновлю.
Вместе с закрытием #30614 и #28071

Comment 5

Repository Robot 2015-01-17 16:28:21 MSK

openvpn-2.3.6-alt1 -> sisyphus:

* Thu Jan 15 2015 Nikolay A. Fetisov <naf@altlinux> 2.3.6-alt1
- New version 2.3.6
- CVE-2014-8104 (Closes: 30529)
- Adding pkcs11 support (Closes: 30614)
- Adding systemd service files (Closes: 28071)