Double free error in OpenVPN for Windows - CVE-2017-7521

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU7143

Double free error in OpenVPN for Windows - CVE-2017-7521

Published: June 21, 2017


Vulnerability identifier: #VU7143
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-7521
CWE-ID: CWE-415
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to double free error when processing --x509-alt-username attribute. A remote unauthenticated attacker can trigger double free error and crash the affected server or potentially execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


Affected software

OpenVPN for Windows

Arch Linux
Debian Linux
Amazon Linux AMI
Fedora
SUSE Linux
Slackware Linux
Ubuntu
Opensuse
openvpn

How to mitigate CVE-2017-7521

Update OpenVPN to version 2.4.3.

openvpn - addressed in versions 2.3.17-1.fc24, 2.4.3-1.el6, 2.4.3-1.el7, 2.4.3-1.fc25, 2.4.3-1.fc26

External References

Related Security Bulletins