medium
6.8
CWE
399
Advisory Published
Updated

CVE-2014-8104

First published: Wed Dec 03 2014(Updated: )

OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
Mageia=4.0
Debian GNU/Linux=7.0
Debian GNU/Linux=8.0
openSUSE=12.3
openSUSE=13.1
openSUSE=13.2
OpenVPN=2.0.1_rc1
OpenVPN=2.0.1_rc2
OpenVPN=2.0.1_rc3
OpenVPN=2.0.1_rc4
OpenVPN=2.0.1_rc5
OpenVPN=2.0.1_rc6
OpenVPN=2.0.1_rc7
OpenVPN=2.0.2_rc1
OpenVPN=2.0.3_rc1
OpenVPN=2.0.4
OpenVPN=2.0.6_rc1
OpenVPN=2.0.9
OpenVPN=2.0_rc1
OpenVPN=2.0_rc2
OpenVPN=2.0_rc3
OpenVPN=2.0_rc4
OpenVPN=2.0_rc5
OpenVPN=2.0_rc6
OpenVPN=2.0_rc7
OpenVPN=2.0_rc8
OpenVPN=2.0_rc9
OpenVPN=2.0_rc10
OpenVPN=2.0_rc11
OpenVPN=2.0_rc12
OpenVPN=2.0_rc13
OpenVPN=2.0_rc14
OpenVPN=2.0_rc15
OpenVPN=2.0_rc16
OpenVPN=2.0_rc17
OpenVPN=2.0_rc18
OpenVPN=2.0_rc19
OpenVPN=2.0_rc20
OpenVPN=2.0_rc21
OpenVPN=2.0_test1
OpenVPN=2.0_test2
OpenVPN=2.0_test3
OpenVPN=2.0_test4
OpenVPN=2.0_test5
OpenVPN=2.0_test6
OpenVPN=2.0_test7
OpenVPN=2.0_test8
OpenVPN=2.0_test9
OpenVPN=2.0_test10
OpenVPN=2.0_test11
OpenVPN=2.0_test12
OpenVPN=2.0_test14
OpenVPN=2.0_test15
OpenVPN=2.0_test16
OpenVPN=2.0_test17
OpenVPN=2.0_test18
OpenVPN=2.0_test19
OpenVPN=2.0_test20
OpenVPN=2.0_test21
OpenVPN=2.0_test22
OpenVPN=2.0_test23
OpenVPN=2.0_test24
OpenVPN=2.0_test25
OpenVPN=2.0_test26
OpenVPN=2.0_test27
OpenVPN=2.0_test28
OpenVPN=2.0_test29
OpenVPN=2.1-beta-1
OpenVPN=2.1-beta-10
OpenVPN=2.1-beta-11
OpenVPN=2.1-beta-12
OpenVPN=2.1-beta-13
OpenVPN=2.1-beta-14
OpenVPN=2.1-beta-15
OpenVPN=2.1-beta-16
OpenVPN=2.1-beta-2
OpenVPN=2.1-beta-3
OpenVPN=2.1-beta-4
OpenVPN=2.1-beta-5
OpenVPN=2.1-beta-6
OpenVPN=2.1-beta-7
OpenVPN=2.1-beta-8
OpenVPN=2.1-beta-9
OpenVPN=2.1-rc_1
OpenVPN=2.1-rc_10
OpenVPN=2.1-rc_11
OpenVPN=2.1-rc_12
OpenVPN=2.1-rc_13
OpenVPN=2.1-rc_14
OpenVPN=2.1-rc_15
OpenVPN=2.1-rc_16
OpenVPN=2.1-rc_17
OpenVPN=2.1-rc_18
OpenVPN=2.1-rc_19
OpenVPN=2.1-rc_2
OpenVPN=2.1-rc_20
OpenVPN=2.1-rc_21
OpenVPN=2.1-rc_22
OpenVPN=2.1-rc_3
OpenVPN=2.1-rc_4
OpenVPN=2.1-rc_5
OpenVPN=2.1-rc_6
OpenVPN=2.1-rc_7
OpenVPN=2.1-rc_8
OpenVPN=2.1-rc_9
OpenVPN=2.1.0
OpenVPN=2.1.1
OpenVPN=2.1.2
OpenVPN=2.1.3
OpenVPN=2.1.4
OpenVPN=2.2-beta1
OpenVPN=2.2-beta2
OpenVPN=2.2-beta3
OpenVPN=2.2-beta4
OpenVPN=2.2-beta5
OpenVPN=2.2.0
OpenVPN=2.2.1
OpenVPN=2.2.2
OpenVPN=2.3-alpha1
OpenVPN=2.3-alpha2
OpenVPN=2.3-alpha3
OpenVPN=2.3-beta1
OpenVPN=2.3-rc1
OpenVPN=2.3-rc2
OpenVPN=2.3.0
OpenVPN=2.3.1
OpenVPN=2.3.2
OpenVPN=2.3.3
OpenVPN=2.3.4
OpenVPN=2.3.5
OpenVPN=2.0.0
OpenVPN=2.0.1
OpenVPN=2.0.2
OpenVPN=2.0.3
OpenVPN=2.0.5
OpenVPN=2.0.6
OpenVPN=2.0.7
OpenVPN=2.0.8
OpenVPN=2.0.10
Ubuntu Linux=12.04
Ubuntu Linux=14.04
Ubuntu Linux=14.10

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2014-8104?

    CVE-2014-8104 has been rated as a medium severity vulnerability due to its potential to cause denial of service by crashing OpenVPN servers.

  • How do I fix CVE-2014-8104?

    To mitigate CVE-2014-8104, upgrade OpenVPN to version 2.0.11 or later, 2.2.3 or later, or 2.3.6 or later.

  • What does CVE-2014-8104 exploit?

    CVE-2014-8104 exploits a vulnerability in OpenVPN’s handling of small control channel packets to crash the server.

  • Which versions of OpenVPN are affected by CVE-2014-8104?

    CVE-2014-8104 affects OpenVPN versions prior to 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6.

  • Can CVE-2014-8104 be exploited remotely?

    Yes, CVE-2014-8104 can be exploited by remote authenticated users, allowing them to crash the OpenVPN server.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203