CVE-2005-2531 Denial of service in n/a
Remote attackers can cause client disconnections in OpenVPN servers configured with verb 0 and no TLS authentication by triggering certificate authentication failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2005-2531?
CVE-2005-2531 is a medium-severity denial of service vulnerability in n/a, published on 24 Aug 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenVPN before 2.0.1, when running with "verb 0" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails certificate authentication to the server and causes the error to be processed by the wrong client, which allows remote attackers to cause a denial of service (client disconnection) via a large number of failed authentication attempts.
Which versions are affected by CVE-2005-2531?
It affects 1 product.
Products include Openvpn Openvpn.
How do I fix CVE-2005-2531?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2005-2531 being exploited?
There is no known exploitation of CVE-2005-2531 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2005-2531, GHSA-h572-qc5h-fc64.