OpenVPN Access server vulnerable to RCE flaw?

pebam

Hello,

Does anyone know which versions of OpenVPN-AS are vulnerable to the recent RCE flaw discovered by Guido Vranken? Patched version of OpenVPN have been announced here https://forums.openvpn.net/viewtopic.php?f=20&t=24346 but there's no mention that I can see of corresponding Access Server versions affected. Does anyone have any insight?

[deleted]

I would definitely like to know the same!

The Johan

Well I don't have all the details but I do know that because Access Server uses TLS auth by default, it's on most servers next to impossible to exploit these particular issues. But there's work being done to fix the issues anyways in the core OpenVPN component that Access Server uses, assuming it's even vulnerable at all. I'm sure a new version and press release will be issued soon.

Asterman

I see the patched version for 2.3 has been released (2.3.17), but the debian packages, even on the Testing branch are still at 2.3.2. Are these no longer updated?

The Johan

Well, repositories for the various operating systems aren't managed by OpenVPN. If you want the latest I suggest you grab it straight from the community openvpn repos directly.

Asterman

What is this then?

https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos

pebam

The latest build for Access Server available seems to be 2.1.6 https://openvpn.net/index.php/access-server/download-openvpn-as-sw/532-release-notes-v200.html. The release notes mention fixes for CVE-2017-7478, CVE-2017-7479 and CVE-2017-5868. But there's no mention of CVE-2017-7521. So I'm still in the dark.

The Johan

Asterman: that's open source version, not Access Server.

Pebam: those last issues are tougher to exploit on AS but still in the code, they'll be fixed soon I'm sure.

pebam

Hello all,
FYI, it looks like the new version with the fixes has been released:https://openvpn.net/index.php/access-server/download-openvpn-as-sw/532-release-notes-v200.html

Thanks all!