Information disclosure in OpenVPN for Windows - CVE-2013-2061
Published: November 18, 2013 / Updated: August 3, 2020
Vulnerability identifier: #VU33315
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-2061
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.
Affected software
OpenVPN for Windows
Amazon Linux AMI
Fedora
openvpn (Alpine package)
openvpn
Amazon Linux AMI
Fedora
openvpn (Alpine package)
openvpn
How to mitigate CVE-2013-2061
Install update from vendor's website.
OpenVPN for Windows - update to 2.3.1
openvpn (Alpine package) - update to 2.1.4-r2
openvpn - update to 2.3.1-1.el5
openvpn (Alpine package) - update to 2.1.4-r2
openvpn - update to 2.3.1-1.el5
External References
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105568.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105609.html
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00012.html
- http://lists.opensuse.org/opensuse-updates/2013-11/msg00016.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:167
- http://www.openwall.com/lists/oss-security/2013/05/06/6
- https://bugs.gentoo.org/show_bug.cgi?id=468756
- https://bugzilla.redhat.com/show_bug.cgi?id=960192
- https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc
- https://github.com/OpenVPN/openvpn/commit/11d21349a4e7e38a025849479b36ace7c2eec2ee