Summary:
Upstream OpenVPN has been audited. The audits identified two remote DoS
vulnerabilities. OpenVPN-NL is _not_ vulnerable to the
pre-authentication DoS attack (CVE-2017-7478), but _is_ vulnerable to
the very inefficient authenticated remote DoS attack (CVE-2017-7479).
Due to the extremely limited nature of CVE-2017-7479, we will not
release an OpenVPN-NL 2.3.x update, but instead continue our focus on
making a 2.4.x release that contains these fixes.
Background:
Upstream OpenVPN 2.4 was simultaneously reviewed by Quarkslab (funded by
OSTIF) and Cryptography Engineering LCC (funded by Private Internet
Access) [0].
These audits both concluded that OpenVPN is a strong product, offering
good security to it's users. Also, both audit praised the efforts of
OpenVPN-NL in hardening both OpenVPN and OpenVPN-NL.
The Quarkslab audit identified two remote Denial-of-Service
vulnerabilities:
1) A pre-authentication Denial of Service (CVE-2017-7478)
This affects OpenVPN 2.3.12 and newer. The most recent OpenVPN-NL is
based on OpenVPN 2.3.9, and therefore _not_ vulnerable.
Please refer to the upstream security announcement [0] for more
information.
2) An authenticated Denial of Service (CVE-2017-7479)
A fully authenticated client can cause the server's the packet-id
counter to roll over, which would lead the server process to hit an
ASSERT() and stop running. To make the server hit the ASSERT(), the
client must first cause the server to send it 2^32 packets (at least
196GB). This makes it a _very_ inefficient DoS attack.
Due to the extremely limited nature of CVE-2017-7479, we will not
release an OpenVPN-NL 2.3.x update, but instead continue our focus on
making a 2.4.x release that contains these fixes.
Please refer to the upstream security announcement [0] for more
information.
[0]
https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineer…
