list-openvpn-nl

list-openvpn-nl@lists.fox-it.com

41 discussions

Vulnerabilities announced at Usenix Security conference
by Max Fillinger 09 Aug '23

09 Aug '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! Vulnerabilities affecting multiple VPN softwares, including OpenVPN and OpenVPN-NL are going to be presented at the Usenix Security conference today. If the local network is operated by a malicious party, the VPN user's routing table can be manipulated so that data that should go through the VPN is sent as plaintext. The OpenVPN developers are currently considering ways to mitigate these vulnerabilities. For now, users can mitigate them as follows: * Specify the VPN server by an IP-address, not by a hostname. If that is not possible, authenticate DNS traffic in some way (e.g., DNSSEC, DNS over HTTPS) *before* setting up the VPN tunnel. * Do not connect to untrusted networks. VPNs do not offer perfect protection against malicious local network operators. * If you have to use an untrusted network, add the block-local flag to redirect-gateway in the client configuration. (Note that this disables all traffic to the local network, so it cannot be added to every configuration.) You can find an explanation of these attacks, including a link to the paper on https://tunnelcrack.mathyvanhoef.com. I include a brief summary below. Typically, routing when running a VPN looks as follows: * All traffic not matching any other rules is sent through the VPN * Traffic to an address in the local network is *not* sent through the VPN. This way, machines in the local network can still be accessed. * Traffic to the VPN server is sent out to the router. # LocalNet Attack In the LocalNet Attack, a malicious DHCP server claims that a public IP address is in the local network. For example, if the attacker wanted to leak traffic to wikipedia.org (91.198.174.192) it would claim that the local network is 91.198.174.0/24. Of course, traffic to websites will usually be encrypted, but it will still leak whether the website is visited or not. This can be prevented by adding the block-local flag to redirect-options (see manual), but it will also block access to any machines in the local network when using the VPN. # ServerIP Attack The ServerIP Attack affects clients that have the VPN server specified by a hostname rather than an IP address. The attacker spoofs the DNS response to make the client use an IP under their control as VPN server. Let's say this IP address is 1.2.3.4. This server proxies the VPN traffic to the actual VPN server so that the user does not notice anything is wrong. Now, the attacker can spoof the DNS responses for other hosts to send traffic to the same server at 1.2.3.4. Because this is the same address as the VPN server, this traffic bypasses the VPN and goes directly to the router. This attack can be prevented by using a hard-coded IP address for the VPN server, or by authenticating DNS in some way (e.g., DNSSEC or DNS over HTTPS) *before* setting up the tunnel. Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQGzBAEBCgAdFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmTTWuIACgkQ5IsYow7q aag9iAwAibWTVheFr+2b3IZk5i1TLymzo0yUSsB71MoCwmOBryPEofOxfFUHvI5/ 2W9Gfufjpeq1UGUZAeAi82vk1NABkoem4W687/StoVH4/MGv4zJNNOAwL2Qe7LdF AQh72tZRarVQj2dGWTds93Imu6Zj1eOzAKIsVbRbuzIsVjRGBBkDMF8E77CL6Rft Iz8Yt8stWMBixiGoiCCipCwHyB9hD2f+wlXByy+3Rg699239sRoQFBtsGwAl24AL F7paRni0cDGIjE/gq7TiFpmFKfnoEjEFmyxeZBYzab7uQER3T1pmxa2b7dNCCz5H gK1zOWaelBUq/A25o9xldLCiO0lKB/uk1mvdYPwulKL7tMvklGPJme7DEc43oTFu jK4ANV3pjKKFJmg2Opo3xJlFX1fyhDWXsKXqda6iWXVLK1tbkmXMqQmDZ7NSO2x4 4jn5QJboZ+Aa8cyYrOyZTlfx0UePAgv3Hj+zDukOWmb8N+XTlMFTWYWOiMdlGG81 ikOTofUE =0k2M -----END PGP SIGNATURE-----

1 0

Metadata changed in RPM packages
by Max Fillinger 13 Jul '23

13 Jul '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! We have changed the metadata of OpenVPN-NL packages for RedHat and SUSE operating systems, for reasons of Fox-IT's security. We send this e-mail so that you are not alarmed if you notice that the packages have changed. The binaries inside the packages are the same as before, and there is no action required on your part. Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQGzBAEBCgAdFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmSv+PcACgkQ5IsYow7q aah1Ywv/VMpD91ugM+6w2QBBicJVeqscvDDvK6pIuezPLUrtRD6FUl9fx5MPOCoA wJwhbdaPuSBVvA+buMRQmYmnEZ2WNBFttU8zZPbQdWkBaPMYKFL16fQJwwFL3Cgb JGY2QZpSF6gts6xlDSlO21f12pznaH7TRzn6ApyYRVcIoeD6gXl9q7OKbL/Nn/fI mJMvD/Lt5PDhj5RO48ZkFiMEFVN9Kb62Mtop4aw/m0EJurNVgBUrLVBZXxmIaDbB CGbA83L8HcvZ37jMrMyL+2LMRthfpfm0v9rh8xmcPH6kXE4cbYCSifKv01WB/0JQ DXYqW8+t6++4MVod3YTw/+qyZO7mNze0RU4leDpH1QcPtNjksXSv2raFzT25+M+b JPZL8CFsecAIxROLC1oddn/zazqBjmrDE2O1DFwE+6T+FfnTSdz/AOIFn1KmzU6g yvMgI6fDyQPNqGvAkbQDnXrUUbe5zG3LlaWq35hBEAFHgBo9jYTMTy7VnOetzJk0 hSbvrAsI =29Ma -----END PGP SIGNATURE-----

1 0

OpenVPN-NL 2.5.6-nl1 released
by Max Fillinger 03 Apr '23

03 Apr '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! I am happy to finally announce the release of OpenVPN-NL 2.5.6-nl1! Packages for Linux and Windows can be downloaded at https://openvpn.fox-it.com. Please note that the deployment advisory has been updated: https://www.aivd.nl/onderwerpen/informatiebeveiliging/documenten/publicatie… As previously announced, the signing key for new Linux releases has been updated. To install the new version with your distribution's package manager, you need to replace the key. The new key can be downloaded at https://openvpn.fox-it.com/repos/fox-crypto-gpg.asc. Its fingerprint is A518F75374D3AF82AE11810A13DF39ED913F5D8F. It has been signed with the previous key. The Windows version is now installed with an MSI installer. Please uninstall the old version before running the new installer. The keys for this mailing list at https://openvpn.fox-it.com/repos/fox-crypto-mailinglist.asc have also been updated. I have extended the validity period of my public key. The keys of colleagues who have moved on to different projects at Fox-IT have been removed. Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQGzBAEBCgAdFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmQrA9kACgkQ5IsYow7q aajk8Qv8DCNrOWp18DGIwT4y9c6F4pT2Pa/x/+1IyUqqekAfhX2HU9zjDYPYt9uw gEjBHdA1coaANRhQ1G1HGqzsQ1/F6Xl7AbWSLt3IiquED6FCEIUELQUipBYn0wN0 JbbNDvRwEg/cfOZOP8tjYsXgWAAQNKFyE2Y0tK11/ry6oDVDE1reCQ39jHCyRru2 xwv6sLOwzTkQr4LN7jSe0rJySjtnpTfmkR/WfbgD6L+daUWSrH5U/vEjWHQPCRxg khn4fiFU57LmTbTpXFfoSGVjMMUQblNO0OJ7TxQFFFcHmwDkOw9wXj/DEglOKbXb LRVrwb8B/wl9RzBAUnqqGBWwga+Rnv36whzamYCw9e+zKJCst/dwH4sMf26Mm98i hbOQF0SVVcnQWTWVcX/Mn6ru5aaTJLF3leZP+2Zy8tgLCc7JTmY2XfMAGnWldQrZ SwymowGCUO5xS2iauF2Yc9i/Cq77e/RyCVjpyncspa7JK7dqyfFaHcoSbJUZXdPb u3Kn4A25 =7xea -----END PGP SIGNATURE-----

1 0

New signing key for Linux packages
by Max Fillinger 03 Mar '23

03 Mar '23

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello! Starting with the upcoming 2.5 release of OpenVPN-NL, we will use a 4096-bit RSA key to sign Linux packages. If you want to install the upcoming packages using your package manager, you will need to add the new key. The new key can be downloaded at: https://openvpn.fox-it.com/repos/fox-crypto-gpg.asc The fingerprint is: A518 F753 74D3 AF82 AE11 810A 13DF 39ED 913F 5D8F The new key has also been signed with the old key. The old key and the signatures on the old releases are still trusted, but 2048 bits are not future-proof enough going forward, hence the upgrade. The signing key for Windows releases already is 4096-bit. Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQHXBAEBCgBBFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmQB6zQjHG1heGltaWxp YW4uZmlsbGluZ2VyQGZveGNyeXB0by5jb20ACgkQ5IsYow7qaagHNwv8D33bcIm8 B4GR3avdIe8CadHJaSCk6KUxSbEWWholvE8456RJv60JKKaeZ+sp08BlvNfJSlVh 78SkmnNRXhNgrSa9PYLCDpALq4j9+fRitYIr8skWCq/w1j1yOanIfLIiKWAqJdFB s2Ly6Pz2kAfl20MsJcggwsUj2sEvX4NZJx/edny6v6d9GORh9Lm5zmJ4R73Owl4b cgykZv7lkhpl7m/1blwXPoqkdx2ZY8ckLFHz8j+lc71bO56efxKvUv8Nanq5HpB9 QwEh2g0Q0zd1iRK9eJ6goLHghfJmvZZp1+mu7qg+M/EtmfZoYsdv3huq7GGfRqCe 9towi4k8MjLsC3lqObD+NjWRah1gJN6baZMbt1BgB6dsfUYIRyocDueRTbGImZNo d9Pp700PTNg9LRfvDDM8nJtom5B2n7FGBaZXE0CKO0z/q163P0GcJgl17PQYY3VG km3afY3SJNae/Pqeep6Q6ieNQBefMIJqwoK/owTDGngTtbdN0/4+0V5p =TRiv -----END PGP SIGNATURE-----

1 0

OpenVPN-NL 2.4.12-nl1 released
by Max Fillinger 14 Apr '22

14 Apr '22

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL (2.4.12-nl1) is available on the OpenVPN-NL website [1]. This version is based on OpenVPN 2.4.12 [2], and mbed TLS 2.16.2 [3]. This release fixes CVE-2022-0547 [4]. OpenVPN 2.4.12 now aborts when there are multiple authentication plugins that are attempting deferred authentication. In earlier versions of OpenVPN, this situation could lead to a potential authentication bypass if one of the plugins accepts the user, but another one does not. Apart from that, it contains several bugfixes and improvements. The Windows installer is now signed with a new key because the old one expired. You can find the new certificate at [5]. Version 2.4.9-nl1 is now deprecated. References - ------------ [1] https://openvpn.fox-it.com/ [2] https://github.com/OpenVPN/openvpn/blob/v2.4.12/Changes.rst [3] https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.2-and-2.7.11-releas… [4] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0547 [5] https://openvpn.fox-it.com/repos/fox-crypto-win-2021.pem -----BEGIN PGP SIGNATURE----- iQHXBAEBCABBFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmJYOQAjHG1heGltaWxp YW4uZmlsbGluZ2VyQGZveGNyeXB0by5jb20ACgkQ5IsYow7qaagIbwv/UPjup8SX ISdGdZjCy702P/jaVCeLg2k8uUdrM8RmPTqF5jptmKWVxb4sIXAwL3LnLmBw3MtN /26Y3eEoxYLR64JfEkYqvgXerX84E2R3AB7tji8d+V0EVX694kqI/P3xXoB5UPpT heEfZLVlJ7A9jiNJ1nyz4om3AHmOm12HfVeLUwZmekcgF6ump/abpPeCfxF3SRPC DmaMJ9JxjRsC3YXvzbT5htizCOQBW+1AF4/+pP3P50jwDsxqG5L2aqprnuC1damP kvE4Ko7ZOdyqFL9pwlCxvogA9zLQPSMzMWyXMyi7TDju3rWumZtb90b0t4SK8KGl 4wFa9anDLluVrxz+bfky5kCXw+lCodoQQWAoL93/oYzm2PMQOBenqsDGdMOq/wOO S/S76pWMqde28JAfkdBz9tfokANho3bUclMhHD1dI93TGaV55BZmVVlv/zuO6e4Y 8sPed0LCxe2w4k1dYBDrCsaXAqmosxBXl5U60Jij99D6NaA9tNLibjaz =2ajQ -----END PGP SIGNATURE-----

1 0

CVE-2022-0547: Possible auth-bypass when using multiple deferred-auth plugins
by Max Fillinger 18 Mar '22

18 Mar '22

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A potential authentication bypass vulnerability has been reported in OpenVPN. This vulnerability was assigned CVE-2022-0547. All versions of OpenVPN-NL 2.4.x are affected as well. When using multiple deferred authentication plugins in an OpenVPN server, it can happen that a user is admitted even if one of the plugins rejects them. This bug can be avoided by running at most one deferred authentication plugin. There is no issue using multiple non-deferred authentication plugins. Link to the announcement at openvpn.net: https://community.openvpn.net/openvpn/wiki/CVE-2022-0547 Best regards, Max Fillinger -----BEGIN PGP SIGNATURE----- iQHXBAEBCABBFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmI07WgjHG1heGltaWxp YW4uZmlsbGluZ2VyQGZveGNyeXB0by5jb20ACgkQ5IsYow7qaaj8TQv/SwbhiidG rriwOpZASgu8jrj9dD7pdslBx9y4iUyqvYhn68mi3J/+9U3TKAvJc/QG/VSpUjzH Q32YRFh8myY7bUrUMsr3w9clJVr94P+yq9VemfXSyMa0cnem+ifLDE0CSOt8Pj6X nBhYHy/72P4ZEx1+ycrJvGruNgGGcSo40u00KMoclrDdfaOemofWjjGTF6UcNGh7 a9XysNhc8ylRODjH0t+Q4oM8BkjKgoX89B/2+f33R0Zv6c7LLGf4ghYGfxQ4LfNy DPpeONTArOe9Dh1GZcGMCo0gbAiLMMbI7YOVETKiK9uTQCMi2JdoIerBU9kbx/7q wi0n+iWKT1ptHlzl8t3UVjJTif4nzRdeaRzpiRwDfY0mF/+Ig2luhzcizLlMaZj8 piD8HvtdPFLOUN7+Ff+Xw27GN021Rg7Uy2NC95dpDFKvSUTWKd8e5x+qH/KXzII/ LGL4WHczDjmjaxUduDb6CR5Z2cQgNdFqG8cm1KWSuFdiMGq0zLzREyVp =wAlk -----END PGP SIGNATURE-----

1 0

OpenVPN-NL 2.3.9-nl4 untrusted
by Max Fillinger 14 Jun '21

14 Jun '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Version 2.3.9-nl4 of OpenVPN-NL is now considered untrusted due to its age. We do not know of any specific vulnerabilities. We recommend to replace it with the current version 2.4.9-nl1. It was marked as untrusted when we released 2.4.9-nl1. I apologize for forgetting to send out the announcement then. -----BEGIN PGP SIGNATURE----- iQGzBAEBCAAdFiEEG9gXxeekKy1t135fT0WOFWw/+OQFAmDHhsgACgkQT0WOFWw/ +ORTOAv+Pe0lL2iQuH/cb2zryRoM3V84u1zyAYYOyn5p0/fiy5FiAtKISz8MRfDf OYuA3MkQd1PyWb3RDK3bud+4g7jyJWW36LafRpuu05UL23D6gMyAeCZERHx9mBSP cbM+aIPTqZKZZCoSjBTOnySY5pDFoYDXN1WQKpFMQEV5cy07FY5TKdzLf9XPIWtU IX1sG33/vMBAvIS+t+GpIyhcAC1wFhHB5wjri09dA+0id0BDQdVcDk85X9RRauBX KTnWd07VEAvUmT26WsACGWM2uxM/D77gUFuFL2DezeobK744XV+adbBxX0fT7bYK CKx6YX/8ErcCuvs1hAJTx5sJ0q3d6j3gNOWHz5I419JNeMbDSBPc3aYqw8geE8CC Y9w7tyIWhlu4+v2ma+OlNuPjIaGnL6KoLC2TLsUu2MPOdcDGNSeNdLbu+A6VBWc+ hRO7DXEmDQ/aSSR+3n1DCnw3sRvs/3QspgSNa5JX9soPG7QaIGknG7Hc2uxoCr71 KcnbKe17 =6R/+ -----END PGP SIGNATURE-----

1 0

OpenVPN-NL 2.4.9-nl1 released
by Max Fillinger 01 Apr '21

01 Apr '21

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL (2.4.9-nl1) is available on the OpenVPN-NL website [1]. This version is based on OpenVPN 2.4.9 [2], and mbed TLS 2.16.2 [3]. This release resolves an issue where OpenVPN-NL might ignore a Certificate Revocation List if it is running in chroot mode. Apart from that, it contains some minor bugfixes and improvements. References - - ---------- [1] https://openvpn.fox-it.com/ [2] https://github.com/OpenVPN/openvpn/blob/v2.4.9/Changes.rst [3] https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.2-and-2.7.11-releas… -----BEGIN PGP SIGNATURE----- iQHXBAEBCABBFiEEXj3Vjj5AbsDlPfHO5IsYow7qaagFAmBl1hojHG1heGltaWxp YW4uZmlsbGluZ2VyQGZveGNyeXB0by5jb20ACgkQ5IsYow7qaagQvQv/blzX47xG 6O9fAO1aeeb3MAzkJv/fCiirj1T3FQsEN3/oApyO5lFqK8mAIzjyWFU8W6IQZbwv hkAgKz6wu6XL0P97/RfKlsjD6ddpBExxaV0slh68iiVEDVKzLWu3N0TTh6YEJBgU yv+1nSF/M2XIMTgzFRVj4e5CCa6Jif3LJclEC1JAM7cFd16FMY+KCNpLnheKndwy jqhrQN5uX1W+bQY5NYUq/0WjLUGak6DqGbljSuftZDRRzjKdfwIUsivmWlV4cvdc kfO2mDlubw6NlAxuEW4EzVH00KGtN45qulUCKUi2hRAitH8jjOlegqPQmCcOD5lq hB4aEB+R22m7AEb6RmxS4s6rLuSxiQqQ4M4TLX1/JQbdhyumIW50/Q7uAESEyS5H RCX9gjumAyuE4kU0SX+cxtz32r9DNLQTQTwhTVPatDMalxISef8Wzey4kyHdEumX OdywBn4reEeCIx99+37Fugtvyg2/77X+/9JrAcH7MJi4QA1ZsdjD066S =4oNV -----END PGP SIGNATURE-----

1 0

OpenVPN-NL 2.4.7-nl1 released
by Steffan Karger 03 Dec '19

03 Dec '19

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 A new version of OpenVPN-NL (2.4.7-nl1) is available on the OpenVPN-NL website [1]. This version is based on OpenVPN 2.4.7 [2], and mbed TLS 2.16.2 [3]. This release resolves an issue where connection setup could hang during authentication when using a PKCS#11 smartcard or token. This release uses a new (Extended Validation) Windows Code signing certificate for the windows installer and binary files. The sha1 fingerprint of this new certificate is: 4E:0B:50:AB:B6:4C:E3:BE:6E:CA:DE:91:B7:2E:54:EC:BC:16:C8:BC The preexisting certificate is still used for tap-windows driver signing. References - ---------- [1] https://openvpn.fox-it.com/ [2] https://github.com/OpenVPN/openvpn/blob/v2.4.7/Changes.rst [3] https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.2-and- 2.7.11-released -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEpoMl4pqcgPPzIMN1QTCd1Y5jXDkFAl3mkhUACgkQQTCd1Y5j XDka8ggAit+RP0sUZnHefbXRTM723MCrRXG9gy7pTpj+UiT3I/obvEY6WBgVb3sg 6KZUiWP1KI64mB8QFnoMLsiYA/lEJ9BYpWFu2deohdJPQ4Gc3bYs4bwvZzrcA2Iy gi+ws+PubihsiNHaIVeDWtaYE1qLvj+PpTQKWHI+KIxYX2NpV7fdaU8r4/XYujHz bbSbeJceuaG5mUKVeBGlN9bfp7rtN3kVz/DZaAn6z49TNqVHSj8fbHNgxVCUUASQ y2RRir8g0AH6X7gY3x9uvyrCkdt5HZ4H6fHGE0HYWKaCjPMcP4QKc10IRwYaz+YR wAZhhbyXuMC4ol//3O4FMUYzFJR6ng== =lAVq -----END PGP SIGNATURE-----

1 0

Security advisory: mbed TLS CVE-2018-0497 and CVE-2018-0498
by Steffan Karger 13 Aug '18

13 Aug '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Summary: OpenVPN-NL is not vulnerable to the two 'high'-rated security issues in the recently published mbed TLS security advisory [0]. Background: Recently, mbed TLS issued new software versions accompanied by a security advisory containing two 'high'-rated security issues: 1) Remote plaintext recovery on use of CBC-based cipher suites through a timing side-channel Researchers showed that the mitigations for the lucky13 attack implemented by mbedtls were not working properly for cipher suites using SHA384 (or SHA512, but those do not exist). This attack applies only when using a TLS cipher suite that combines AES-CBC with SHA384. OpenVPN-NL does not support such a cipher suite, and is therefor not vulnerable. 2) Plaintext recovery on use of CBC-based cipher suites through a cache based side-channel Similar to the above, the implementation of the same cipher suites was also vulnerable to cache-based side-channel attacks. OpenVPN-NL does not support any of the affected cipher suites, and is therefor not vulnerable. [0] https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-a dvisory-2018-02 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJbcaVdAAoJEEEwndWOY1w5t2gH/1RLAaSxQvNuk/DXLJ/20UAd lMi4t21qnFoGIGkYUOVrVuW2qHEH3EJYZD+ioQ+tptAYVwm9j60vsLNStJVPhb+u Qtn0cYcb4npQrF7VFJCDkMNAM8vQU+DZJ30zC/GOuewYi9/s2XoFrwEHIXFG4kCH v4/+R72xEhMF2uJWjZ/ZReBmNM4BRdis+/IV92F7/86BacEuPH8LHSLb90B9gujL L4nJF3kveOH9Tp5rXnoAoEUb47mSCQ5oAe6bf2k8ddxl9k7vIAaOT8jzgJycxbAz CaHLG+WlTKLbpJ+W0xw1FkybkT31HRcpdn9jz9DS1CuHLweKWy8UhUPp3Tt5puQ= =jCKW -----END PGP SIGNATURE-----

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

list-openvpn-nl