CVE-2006-2229: Medium severity openvpn openvpn vulnerability
OpenVPN 2.0.7 and earlier, when configured to use the --management option with an IP that is not 127.0.0.1, uses a cleartext password for TCP sessions to the management interface, which might allow remote attackers to view sensitive information or cause a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2229?
CVE-2006-2229 is considered a moderate severity vulnerability that could lead to sensitive information disclosure or denial of service.
How do I fix CVE-2006-2229?
To fix CVE-2006-2229, configure OpenVPN's management interface to listen only on localhost by using the 127.0.0.1 address.
What software versions are affected by CVE-2006-2229?
CVE-2006-2229 affects OpenVPN versions 2.0.7 and earlier, including various beta, release candidate, and test versions.
What can attackers do with CVE-2006-2229?
Attackers can exploit CVE-2006-2229 to gain access to cleartext passwords used in TCP sessions to the management interface.
Is CVE-2006-2229 widely exploited?
While there may not be reports of widespread exploitation of CVE-2006-2229, the vulnerability poses a risk to systems that have misconfigured management access.