CVE-2005-2532: Medium severity OpenVPN OpenVPN vulnerability

Published Aug 24, 2005

Updated

OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server, which allows remote authenticated attackers to cause a denial of service (client disconnection) via a large number of packets that can not be decrypted.

Affected Software

74 affected components

OpenVPN OpenVPN=2.0_beta13

OpenVPN OpenVPN=2.0_rc9

OpenVPN OpenVPN=2.0_test19

OpenVPN OpenVPN=2.0

OpenVPN OpenVPN=2.0_test17

OpenVPN OpenVPN=2.0_test10

OpenVPN OpenVPN=2.0_test23

OpenVPN OpenVPN=2.0_beta20

OpenVPN OpenVPN=2.0.1_rc3

OpenVPN OpenVPN=2.0_beta19

OpenVPN OpenVPN=2.0_rc19

OpenVPN OpenVPN=2.0_beta1

OpenVPN OpenVPN=2.0_rc21

OpenVPN OpenVPN=2.0_beta9

OpenVPN OpenVPN=2.0.1_rc4

OpenVPN OpenVPN=2.0.1_rc2

OpenVPN OpenVPN=2.0_test26

OpenVPN OpenVPN=2.0_rc2

OpenVPN OpenVPN=2.0_test1

OpenVPN OpenVPN=2.0_beta16

OpenVPN OpenVPN=2.0_beta10

OpenVPN OpenVPN=2.0_rc20

OpenVPN OpenVPN=2.0_test14

OpenVPN OpenVPN=2.0_test6

OpenVPN OpenVPN=2.0_test12

OpenVPN OpenVPN=2.0_rc3

OpenVPN OpenVPN=2.0_beta15

OpenVPN OpenVPN=2.0_rc12

OpenVPN OpenVPN=2.0_beta8

OpenVPN OpenVPN=2.0_test3

OpenVPN OpenVPN=2.0_beta5

OpenVPN OpenVPN=2.0_beta18

OpenVPN OpenVPN=2.0_rc5

OpenVPN OpenVPN=2.0_rc6

OpenVPN OpenVPN=2.0_rc11

OpenVPN OpenVPN=2.0_rc7

OpenVPN OpenVPN=2.0_rc4

OpenVPN OpenVPN=2.0_beta2

OpenVPN OpenVPN=2.0_rc16

OpenVPN OpenVPN=2.0_test29

OpenVPN OpenVPN=2.0_beta3

OpenVPN OpenVPN=2.0_test9

OpenVPN OpenVPN=2.0_test27

OpenVPN OpenVPN=2.0_test21

OpenVPN OpenVPN=2.0_beta28

OpenVPN OpenVPN=2.0_rc17

OpenVPN OpenVPN=2.0_test5

OpenVPN OpenVPN=2.0_test20

OpenVPN OpenVPN=2.0_rc10

OpenVPN OpenVPN=2.0_rc8

OpenVPN OpenVPN=2.0.1_rc1

OpenVPN OpenVPN=2.0_test22

OpenVPN OpenVPN=2.0_test11

OpenVPN OpenVPN=2.0_test24

OpenVPN OpenVPN=2.0.1_rc6

OpenVPN OpenVPN=2.0_test7

OpenVPN OpenVPN=2.0.1_rc7

OpenVPN OpenVPN=2.0_rc14

OpenVPN OpenVPN=2.0_rc18

OpenVPN OpenVPN=2.0_beta17

OpenVPN OpenVPN=2.0_test15

OpenVPN OpenVPN=2.0_test8

OpenVPN OpenVPN=2.0_rc1

OpenVPN OpenVPN=2.0.1_rc5

OpenVPN OpenVPN=2.0_beta4

OpenVPN OpenVPN=2.0_test2

OpenVPN OpenVPN=2.0_beta6

OpenVPN OpenVPN=2.0_rc15

OpenVPN OpenVPN=2.0_beta7

OpenVPN OpenVPN=2.0_beta11

OpenVPN OpenVPN=2.0_test18

OpenVPN OpenVPN=2.0_test16

OpenVPN OpenVPN=2.0_rc13

OpenVPN OpenVPN=2.0_beta12

Remediation

Patch Available

http://www.mandriva.com/security/advisories?name=MDKSA-2005:145

Event History

Aug 24, 2005

CVE Published

04:00 AM

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-2532?

CVE-2005-2532 is classified as a denial of service vulnerability that can lead to unexpected client disconnections.

How do I fix CVE-2005-2532?

To mitigate CVE-2005-2532, upgrade to OpenVPN version 2.0.1 or later to ensure proper error queue flushing.

What types of attacks can exploit CVE-2005-2532?

CVE-2005-2532 can be exploited by remote authenticated attackers sending a series of non-decryptable packets.

Is my version of OpenVPN vulnerable to CVE-2005-2532?

If you are using OpenVPN versions prior to 2.0.1, you are vulnerable to CVE-2005-2532.

What impact does CVE-2005-2532 have on my OpenVPN service?

CVE-2005-2532 can cause service disruptions by forcibly disconnecting clients, impacting overall availability.