SB2017080702 - Ubuntu update for OpenVPN

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017080702

SB2017080702 - Ubuntu update for OpenVPN

Published: August 7, 2017

Security Bulletin ID SB2017080702
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) MitM attack (CVE-ID: CVE-2017-7520)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack or obtain potentially sensitive client's information.

If clients use a HTTP proxy with NTLM authentication (i.e. "--http-proxy <server> <port> [<authfile>|'auto'|'auto-nct'] ntlm2"), a man-in-the-middle attacker between the client and the proxy can cause the client to crash or disclose at most 96 bytes of stack memory. The disclosed stack memory is likely to contain the proxy password.


Remediation

Install update from vendor's website.

References