CVE-2017-7478
OpenVPN 2.4.0 - Denial of Service
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.
OpenVPN versión 2.3.12 y más recientes, son vulnerables a la Denegación de Servicio no autenticada del servidor por medio de un paquete de control grande recibido. Tenga en cuenta que este problema se corrige en versiones 2.3.15 y 2.4.2.
It was discovered that OpenVPN improperly triggered an assert when receiving an oversized control packet in some situations. A remote attacker could use this to cause a denial of service. It was discovered that OpenVPN improperly triggered an assert when packet ids rolled over. An authenticated remote attacker could use this to cause a denial of service. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-04-05 CVE Reserved
- 2017-05-11 CVE Published
- 2017-05-12 First Exploit
- 2024-08-05 CVE Updated
- 2025-07-24 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
- CWE-617: Reachable Assertion
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/98444 | Vdb Entry | |
| http://www.securitytracker.com/id/1038473 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/142489 | 2017-05-12 | |
| https://www.exploit-db.com/exploits/41993 | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits | 2017-08-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Openvpn Search vendor "Openvpn" | Openvpn Search vendor "Openvpn" for product "Openvpn" | 2.3.12 Search vendor "Openvpn" for product "Openvpn" and version "2.3.12" | - |
Affected
| ||||||
| Openvpn Search vendor "Openvpn" | Openvpn Search vendor "Openvpn" for product "Openvpn" | 2.3.13 Search vendor "Openvpn" for product "Openvpn" and version "2.3.13" | - |
Affected
| ||||||
| Openvpn Search vendor "Openvpn" | Openvpn Search vendor "Openvpn" for product "Openvpn" | 2.3.14 Search vendor "Openvpn" for product "Openvpn" and version "2.3.14" | - |
Affected
| ||||||
| Openvpn Search vendor "Openvpn" | Openvpn Search vendor "Openvpn" for product "Openvpn" | 2.4.0 Search vendor "Openvpn" for product "Openvpn" and version "2.4.0" | - |
Affected
| ||||||
| Openvpn Search vendor "Openvpn" | Openvpn Search vendor "Openvpn" for product "Openvpn" | 2.4.0 Search vendor "Openvpn" for product "Openvpn" and version "2.4.0" | alpha2 |
Affected
| ||||||
| Openvpn Search vendor "Openvpn" | Openvpn Search vendor "Openvpn" for product "Openvpn" | 2.4.0 Search vendor "Openvpn" for product "Openvpn" and version "2.4.0" | beta1 |
Affected
| ||||||
| Openvpn Search vendor "Openvpn" | Openvpn Search vendor "Openvpn" for product "Openvpn" | 2.4.0 Search vendor "Openvpn" for product "Openvpn" and version "2.4.0" | beta2 |
Affected
| ||||||
| Openvpn Search vendor "Openvpn" | Openvpn Search vendor "Openvpn" for product "Openvpn" | 2.4.0 Search vendor "Openvpn" for product "Openvpn" and version "2.4.0" | rc1 |
Affected
| ||||||
| Openvpn Search vendor "Openvpn" | Openvpn Search vendor "Openvpn" for product "Openvpn" | 2.4.0 Search vendor "Openvpn" for product "Openvpn" and version "2.4.0" | rc2 |
Affected
| ||||||
| Openvpn Search vendor "Openvpn" | Openvpn Search vendor "Openvpn" for product "Openvpn" | 2.4.1 Search vendor "Openvpn" for product "Openvpn" and version "2.4.1" | - |
Affected
| ||||||