USN-3339-1: OpenVPN vulnerabilities

Ubuntu Security Notice USN-3339-1

22nd June, 2017

openvpn vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 17.04



• Ubuntu 16.10



• Ubuntu 16.04 LTS



• Ubuntu 14.04 LTS

Summary

Several security issues were fixed in OpenVPN.

Software description

• openvpn
  - virtual private network software
  
  

Details

Karthikeyan Bhargavan and Gaëtan Leurent discovered that 64-bit block
ciphers are vulnerable to a birthday attack. A remote attacker could
possibly use this issue to recover cleartext data. Fixing this issue
requires a configuration change to switch to a different cipher. This
update adds a warning to the log file when a 64-bit block cipher is in use.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and
Ubuntu 16.10. ()

Guido Vranken discovered that OpenVPN incorrectly handled certain malformed
IPv6 packets. A remote attacker could use this issue to cause OpenVPN to
crash, resulting in a denial of service. ()

Guido Vranken discovered that OpenVPN incorrectly handled an HTTP proxy
with NTLM authentication. A remote attacker could use this issue to cause
OpenVPN clients to crash, resulting in a denial of service, or possibly
expose sensitive memory contents. ()

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 17.04:

Ubuntu 16.10:

Ubuntu 16.04 LTS:

Ubuntu 14.04 LTS:

To update your system, please follow these instructions:
,

,

,

CVE-2017-7521