Bug 30529 - CVE-2014-8104 Critical denial of service vulnerability in OpenVPN servers
Summary: CVE-2014-8104 Critical denial of service vulnerability in OpenVPN servers
Status: CLOSED FIXED
Alias: None
Product: Sisyphus
Classification: Development
Component: openvpn (show other bugs)
Version: unstable
Hardware: all Linux
: P3 normal
Assignee: Nikolay A. Fetisov
QA Contact: qa-sisyphus
URL: https://security-tracker.debian.org/t...
Keywords: security
Depends on:
Blocks:
 
Reported: 2014-12-02 14:24 MSK by Mike Lykov
Modified: 2015-01-17 16:28 MSK (History)
3 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Lykov 2014-12-02 14:24:57 MSK 
Dragana Damjanovic discovered that an authenticated client could crash
an OpenVPN server by sending a control packet containing less than
four bytes as payload.

удаленное использование ошибки возможно для вызова падения сервера, надо бы версию обновить (а то Built: almost 3 years ago)
Comment 1 Michael Shigorin 2014-12-03 13:09:20 MSK 
Как вариант, задокументировать реализацию gear-репозитория с переносом апстримных исходников в подкаталог -- вчера сходу не сообразил.
Comment 2 Anton Farygin 2015-01-15 17:45:05 MSK 
ping мейнтейнер ?
Comment 3 Michael Shigorin 2015-01-15 21:27:58 MSK 
См. тж. bug #30319
Comment 4 Nikolay A. Fetisov 2015-01-15 21:37:51 MSK 
До OpenVPN добрался, сегодня обновлю.
Вместе с закрытием #30614 и #28071
Comment 5 Repository Robot 2015-01-17 16:28:21 MSK 
openvpn-2.3.6-alt1 -> sisyphus:

* Thu Jan 15 2015 Nikolay A. Fetisov <naf@altlinux> 2.3.6-alt1
- New version 2.3.6
- CVE-2014-8104 (Closes: 30529)
- Adding pkcs11 support (Closes: 30614)
- Adding systemd service files (Closes: 28071)