Executive brief
OpenVPN is a widely-used open-source VPN application that allows secure remote network access. This vulnerability in the argument parsing logic on Windows systems could allow an authenticated remote attacker to execute arbitrary commands on the affected system through a specially crafted certificate subject field, potentially compromising the security of the VPN connection and the host system.
Technical details
The vulnerability is an argument parsing issue affecting OpenVPN on Windows platforms. It exists in versions 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6. An authenticated remote attacker can exploit this by providing a crafted certificate subject to trigger command execution. The attack requires prior authentication and a network connection to the OpenVPN instance. Successful exploitation allows arbitrary command execution with the privileges of the OpenVPN process. Patches are available in versions after 2.6.22 and 2.7.6.
Affected products
- OpenVPN OpenVPN 2.1_rc10 through 2.6.22, 2.7_alpha1 through 2.7.6 on Windows