CVE-2005-2534: Race Condition

Published Aug 24, 2005

Updated

Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service (server crash) via simultaneous TCP connections from multiple clients that use the same client certificate.

Affected Software

74 affected components

OpenVPN OpenVPN=2.0

OpenVPN OpenVPN=2.0.1_rc1

OpenVPN OpenVPN=2.0.1_rc2

OpenVPN OpenVPN=2.0.1_rc3

OpenVPN OpenVPN=2.0.1_rc4

OpenVPN OpenVPN=2.0.1_rc5

OpenVPN OpenVPN=2.0.1_rc6

OpenVPN OpenVPN=2.0.1_rc7

OpenVPN OpenVPN=2.0_beta1

OpenVPN OpenVPN=2.0_beta2

OpenVPN OpenVPN=2.0_beta3

OpenVPN OpenVPN=2.0_beta4

OpenVPN OpenVPN=2.0_beta5

OpenVPN OpenVPN=2.0_beta6

OpenVPN OpenVPN=2.0_beta7

OpenVPN OpenVPN=2.0_beta8

OpenVPN OpenVPN=2.0_beta9

OpenVPN OpenVPN=2.0_beta10

OpenVPN OpenVPN=2.0_beta11

OpenVPN OpenVPN=2.0_beta12

OpenVPN OpenVPN=2.0_beta13

OpenVPN OpenVPN=2.0_beta15

OpenVPN OpenVPN=2.0_beta16

OpenVPN OpenVPN=2.0_beta17

OpenVPN OpenVPN=2.0_beta18

OpenVPN OpenVPN=2.0_beta19

OpenVPN OpenVPN=2.0_beta20

OpenVPN OpenVPN=2.0_beta28

OpenVPN OpenVPN=2.0_rc1

OpenVPN OpenVPN=2.0_rc2

OpenVPN OpenVPN=2.0_rc3

OpenVPN OpenVPN=2.0_rc4

OpenVPN OpenVPN=2.0_rc5

OpenVPN OpenVPN=2.0_rc6

OpenVPN OpenVPN=2.0_rc7

OpenVPN OpenVPN=2.0_rc8

OpenVPN OpenVPN=2.0_rc9

OpenVPN OpenVPN=2.0_rc10

OpenVPN OpenVPN=2.0_rc11

OpenVPN OpenVPN=2.0_rc12

OpenVPN OpenVPN=2.0_rc13

OpenVPN OpenVPN=2.0_rc14

OpenVPN OpenVPN=2.0_rc15

OpenVPN OpenVPN=2.0_rc16

OpenVPN OpenVPN=2.0_rc17

OpenVPN OpenVPN=2.0_rc18

OpenVPN OpenVPN=2.0_rc19

OpenVPN OpenVPN=2.0_rc20

OpenVPN OpenVPN=2.0_rc21

OpenVPN OpenVPN=2.0_test1

OpenVPN OpenVPN=2.0_test2

OpenVPN OpenVPN=2.0_test3

OpenVPN OpenVPN=2.0_test5

OpenVPN OpenVPN=2.0_test6

OpenVPN OpenVPN=2.0_test7

OpenVPN OpenVPN=2.0_test8

OpenVPN OpenVPN=2.0_test9

OpenVPN OpenVPN=2.0_test10

OpenVPN OpenVPN=2.0_test11

OpenVPN OpenVPN=2.0_test12

OpenVPN OpenVPN=2.0_test14

OpenVPN OpenVPN=2.0_test15

OpenVPN OpenVPN=2.0_test16

OpenVPN OpenVPN=2.0_test17

OpenVPN OpenVPN=2.0_test18

OpenVPN OpenVPN=2.0_test19

OpenVPN OpenVPN=2.0_test20

OpenVPN OpenVPN=2.0_test21

OpenVPN OpenVPN=2.0_test22

OpenVPN OpenVPN=2.0_test23

OpenVPN OpenVPN=2.0_test24

OpenVPN OpenVPN=2.0_test26

OpenVPN OpenVPN=2.0_test27

OpenVPN OpenVPN=2.0_test29

Remediation

Patch Available

http://www.mandriva.com/security/advisories?name=MDKSA-2005:145

Event History

Aug 24, 2005

CVE Published

04:00 AM

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-2534?

CVE-2005-2534 has been classified as a medium severity vulnerability due to its potential to cause a denial of service.

How do I fix CVE-2005-2534?

To remediate CVE-2005-2534, upgrade OpenVPN to version 2.0.1 or later, as earlier versions are affected.

What types of attacks does CVE-2005-2534 allow?

CVE-2005-2534 allows remote attackers to crash the OpenVPN server through simultaneous TCP connections using the same client certificate.

Which versions of OpenVPN are affected by CVE-2005-2534?

CVE-2005-2534 affects OpenVPN versions prior to 2.0.1, including various release candidates and beta versions.

What is the impact of exploiting CVE-2005-2534?

Exploiting CVE-2005-2534 can lead to a denial of service, causing the OpenVPN server to crash and disrupt service.