OpenVPN server DoS vulnerability fixed

Published: 2014-12-02
Last Updated: 2014-12-03 00:09:44 UTC
by Jim Clausing (Version: 1)
0 comment(s)

The OpenVPN folks released a security advisory and updates to its server software yesterday for a vulnerability that has existed in the source code since 2005.  CVE-2014-8104 is a vulnerability that can result in an OpenVPN server crashing when sent a too-short control channel packet.  Note, that in their words "both client certificates and TLS auth will protect against this exploit as long as all OpenVPN clients can be trusted to not be compromised and/or malicious."  If I'm reading this correctly, this means that adding "tls-auth <keyfile> (0|1)" (as appropriate) to the configuration files on both server and client as well as using client certificates should protect against this attack.  Folks running OpenVPN servers are strongly urged to update to v2.3.6 as soon as possible.  The fixes have also been backported to v2.2 and can be found in the git repository, but may also exist in earlier v2.x code if anyone is still running old server software.  Note that the v3.x code used in most OpenVPN Connect clients (such as those for Android and iOS) are not vulnerable.  My Ubuntu systems got the update last night, so if you are running an OpenVPN server on Linux hopefully the patches are available via the usual package update mechanism or soon will be.

References:

https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b

---------------
Jim Clausing, GIAC GSE #26
jclausing --at-- isc [dot] sans (dot) edu

Keywords:
0 comment(s)

Does Your Vulnerability Scanner Speak Portuguese?

Published: 2014-12-02
Last Updated: 2014-12-02 18:39:53 UTC
by Johannes Ullrich (Version: 1)
2 comment(s)

Rodrigo Montoro and Joaquim Espinhara did an interesting test, and like so many interesting tests, it is actually pretty obvious in hindsight: They looked at different vulnerability scanners, and checked how they behave if a web site is coded in a language other then English [1]. The quick answer: They pretty much fail. The presentation is looking at a couple of open source and commercial scanners, and threw in snort as an IDS. Turns out all of the scanners (and snort) have issues recognizing evidence of vulnerabilities (like SQL error messages) if the language is changed to anything but english.

Lessons?

- don't just trust your vulnerability scanner. A "clean bill" from a basic vulnerability scanner doesn't mean you have no vulnerabilities.
- watch your error logs while the scan is in progress. You may find a lot more evidence of problems that way, in particular if you are not very forthcoming on error messages.
- configure your scanner (and in the case of snort: your IDS) correctly. Maybe adjust your server configuration to make it easier for the scanner to find problems.
- and yes... a web site written in Klingon is likely much more difficult to hack, but also not that useful (they don't pay!)
 

On a similar note: Some sites use different code for different language versions of the site. In this case, it is very important to test all language versions, which may not be easy.

[1] http://www.slideshare.net/spookerlabs/lost-in-translation-blackhat-brazil-2014

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

Keywords:
2 comment(s)
We will be performing some extensive updates to our backend today. Sorry for any outages/errors you may be seeing.
ISC StormCast for Tuesday, December 2nd 2014 http://isc.sans.edu/podcastdetail.html?id=4257

Comments


Diary Archives