CVE-2017-7478

説明

CVE.org より

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.

詳細

Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

脆弱性の原因 (CWE) の理解

CWE-617

Availability

Technical Impact: DoS: Crash, Exit, or Restart

An attacker that can trigger an assert statement can still lead to a denial of service if the relevant code can be triggered by an attacker, and if the scope of the assert() extends beyond the attacker's own session.

謝辞

Red Hat would like to thank the OpenVPN project for reporting this issue. Upstream acknowledges QuarksLab as the original reporter.

よくある質問

Not sure what something means? Check out our Security Glossary.

エラータ通知の受信を希望しますか? こちらで登録してください。