Improper authentication in OpenVPN for Windows - CVE-2020-15078

Vulnerability identifier: #VU52479

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-15078

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker can bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.

Under certain circumstances an attacker can trick the server using delayed authentication (plugin or management) into returning a PUSH_REPLY before the AUTH_FAILED message, which can possibly be used to gather information about a VPN setup. In combination with "--auth-gen-token" or a user-specific token auth solution it can be possible to get access to a VPN with an otherwise-invalid account.

OpenVPN for Windows
Gentoo Linux
Amazon Linux AMI
Fedora
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Basesystem
Ubuntu
openEuler
openvpn-openssl1-down-root-plugin
openvpn-openssl1
openvpn-debugsource
openvpn-debuginfo
openvpn-auth-pam-plugin-debuginfo
openvpn-auth-pam-plugin
openvpn
openvpn-devel
openvpn (Ubuntu package)
openvpn-help
IBM MaaS360 Cloud Extender Agent
IBM MaaS360 Ceriticate Integration Module
IBM MaaS360 Base Module
IBM MaaS360 VPN Module

Install updates from vendor's website.

OpenVPN for Windows - addressed in versions 2.4.11, 2.5.2
openvpn-openssl1-down-root-plugin - update to 2.3.2-0.10.9.1
openvpn-openssl1 - update to 2.3.2-0.10.9.1
openvpn-debugsource - addressed in versions 2.3.8-16.26.1, 2.4.3-5.7.1
openvpn-debuginfo - addressed in versions 2.3.8-16.26.1, 2.4.3-5.7.1
openvpn-auth-pam-plugin-debuginfo - addressed in versions 2.3.8-16.26.1, 2.4.3-5.7.1
openvpn-auth-pam-plugin - addressed in versions 2.3.8-16.26.1, 2.4.3-5.7.1
openvpn - addressed in versions 2.3.8-16.26.1, 2.4.3-5.7.1
openvpn-devel - update to 2.4.3-5.7.1
openvpn (Ubuntu package) - addressed in versions 2.4.4-2ubuntu1.5, 2.4.7-1ubuntu2.20.04.2, 2.4.9-3ubuntu1.1, 2.5.1-1ubuntu1.1
openvpn-debuginfo - update to 2.4.8-7
openvpn-debugsource - update to 2.4.8-7
openvpn-devel - update to 2.4.8-7
openvpn-help - update to 2.4.8-7
openvpn - update to 2.4.8-7
openvpn - addressed in versions 2.4.11-1.el7, 2.4.11-1.el8, 2.4.11-1.fc32, 2.4.11-1.fc33, 2.5.2-1.fc34
IBM MaaS360 Cloud Extender Agent - update to 2.105.300.005
IBM MaaS360 Ceriticate Integration Module - update to 2.105.300.005
IBM MaaS360 VPN Module - update to 2.105.300.005
IBM MaaS360 Base Module - update to 2.105.300.005

• https://github.com/OpenVPN/openvpn/releases/tag/v2.4.11
• https://github.com/OpenVPN/openvpn/releases/tag/v2.5.2
• https://community.openvpn.net/openvpn/wiki/CVE-2020-15078

• Denial of service in OpenVPN
• Gentoo update for OpenVPN
• Amazon Linux AMI update for openvpn
• Ubuntu update for openvpn
• Multiple vulnerabilities in IBM MaaS360 Cloud Extender and Modules
• openEuler 20.03 LTS SP1 update for openvpn
• SUSE update for openvpn-openssl1
• SUSE update for openvpn
• SUSE update for openvpn
• Fedora 32 update for openvpn
• Fedora EPEL 8 update for openvpn
• Fedora EPEL 7 update for openvpn
• Fedora 33 update for openvpn
• Fedora 34 update for openvpn