CVE-2005-2533: Low severity OpenVPN OpenVPN vulnerability

Published Aug 24, 2005

Updated

OpenVPN before 2.0.1, when running in "dev tap" Ethernet bridging mode, allows remote authenticated clients to cause a denial of service (memory exhaustion) via a flood of packets with a large number of spoofed MAC addresses.

Affected Software

74 affected components

OpenVPN OpenVPN=2.0

OpenVPN OpenVPN=2.0.1_rc1

OpenVPN OpenVPN=2.0.1_rc2

OpenVPN OpenVPN=2.0.1_rc3

OpenVPN OpenVPN=2.0.1_rc4

OpenVPN OpenVPN=2.0.1_rc5

OpenVPN OpenVPN=2.0.1_rc6

OpenVPN OpenVPN=2.0.1_rc7

OpenVPN OpenVPN=2.0_beta1

OpenVPN OpenVPN=2.0_beta2

OpenVPN OpenVPN=2.0_beta3

OpenVPN OpenVPN=2.0_beta4

OpenVPN OpenVPN=2.0_beta5

OpenVPN OpenVPN=2.0_beta6

OpenVPN OpenVPN=2.0_beta7

OpenVPN OpenVPN=2.0_beta8

OpenVPN OpenVPN=2.0_beta9

OpenVPN OpenVPN=2.0_beta10

OpenVPN OpenVPN=2.0_beta11

OpenVPN OpenVPN=2.0_beta12

OpenVPN OpenVPN=2.0_beta13

OpenVPN OpenVPN=2.0_beta15

OpenVPN OpenVPN=2.0_beta16

OpenVPN OpenVPN=2.0_beta17

OpenVPN OpenVPN=2.0_beta18

OpenVPN OpenVPN=2.0_beta19

OpenVPN OpenVPN=2.0_beta20

OpenVPN OpenVPN=2.0_beta28

OpenVPN OpenVPN=2.0_rc1

OpenVPN OpenVPN=2.0_rc2

OpenVPN OpenVPN=2.0_rc3

OpenVPN OpenVPN=2.0_rc4

OpenVPN OpenVPN=2.0_rc5

OpenVPN OpenVPN=2.0_rc6

OpenVPN OpenVPN=2.0_rc7

OpenVPN OpenVPN=2.0_rc8

OpenVPN OpenVPN=2.0_rc9

OpenVPN OpenVPN=2.0_rc10

OpenVPN OpenVPN=2.0_rc11

OpenVPN OpenVPN=2.0_rc12

OpenVPN OpenVPN=2.0_rc13

OpenVPN OpenVPN=2.0_rc14

OpenVPN OpenVPN=2.0_rc15

OpenVPN OpenVPN=2.0_rc16

OpenVPN OpenVPN=2.0_rc17

OpenVPN OpenVPN=2.0_rc18

OpenVPN OpenVPN=2.0_rc19

OpenVPN OpenVPN=2.0_rc20

OpenVPN OpenVPN=2.0_rc21

OpenVPN OpenVPN=2.0_test1

OpenVPN OpenVPN=2.0_test2

OpenVPN OpenVPN=2.0_test3

OpenVPN OpenVPN=2.0_test5

OpenVPN OpenVPN=2.0_test6

OpenVPN OpenVPN=2.0_test7

OpenVPN OpenVPN=2.0_test8

OpenVPN OpenVPN=2.0_test9

OpenVPN OpenVPN=2.0_test10

OpenVPN OpenVPN=2.0_test11

OpenVPN OpenVPN=2.0_test12

OpenVPN OpenVPN=2.0_test14

OpenVPN OpenVPN=2.0_test15

OpenVPN OpenVPN=2.0_test16

OpenVPN OpenVPN=2.0_test17

OpenVPN OpenVPN=2.0_test18

OpenVPN OpenVPN=2.0_test19

OpenVPN OpenVPN=2.0_test20

OpenVPN OpenVPN=2.0_test21

OpenVPN OpenVPN=2.0_test22

OpenVPN OpenVPN=2.0_test23

OpenVPN OpenVPN=2.0_test24

OpenVPN OpenVPN=2.0_test26

OpenVPN OpenVPN=2.0_test27

OpenVPN OpenVPN=2.0_test29

Remediation

Patch Available

http://www.mandriva.com/security/advisories?name=MDKSA-2005:145

Event History

Aug 24, 2005

CVE Published

04:00 AM

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-2533?

CVE-2005-2533 has a severity rating that indicates it can lead to denial of service due to memory exhaustion from a packet flood.

How do I fix CVE-2005-2533?

To fix CVE-2005-2533, upgrade to OpenVPN version 2.0.1 or later as this addresses the vulnerability.

What versions of OpenVPN are affected by CVE-2005-2533?

OpenVPN versions prior to 2.0.1, including all 2.0.x pre-release versions, are affected by CVE-2005-2533.

What does CVE-2005-2533 exploit?

CVE-2005-2533 exploits OpenVPN's Ethernet bridging mode by allowing remote authenticated clients to flood it with packets containing spoofed MAC addresses.

What are the consequences of CVE-2005-2533?

The consequences of CVE-2005-2533 include potential service disruption and denial of access due to memory exhaustion.