CVE-2017-7478 Denial of service in openvpn
Unauthenticated attackers can cause a denial of service on OpenVPN servers by sending large control packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7478?
CVE-2017-7478 is a high-severity denial of service vulnerability in openvpn, published on 15 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.
Which versions are affected by CVE-2017-7478?
It affects 1 product.
Products include Openvpn Openvpn.
How do I fix CVE-2017-7478?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-7478 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-7478 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in openvpn
Sources
Also known as ALPINE-CVE-2017-7478, DEBIAN-CVE-2017-7478, GHSA-3wwj-66cm-595v.