It was discovered that an authenticated client could trigger an ASSERT() in OpenVPN by sending a too-short control channel packet to the server. This could cause the OpenVPN server to crash and deny access to the VPN to other legitimate users. Acknowledgements: Red Hat would like to thank the OpenVPN project for reporting this issue. Upstream acknowledges Dragana Damjanovic as the original reporter.
Created attachment 960011 [details] upstream patch
External References: http://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b
Created openvpn tracking bugs for this issue: Affects: fedora-all [bug 1169487] Affects: epel-all [bug 1169488]
Note that an update has been submitted for Fedora 21: https://admin.fedoraproject.org/updates/openvpn-2.3.6-1.fc21 Also note the following mitigating factors from the upstream announcement: """ Only tls-authenticated clients can trigger the vulnerability in the OpenVPN server. Thus both client certificates and TLS auth will protect against this exploit as long as all OpenVPN clients can be trusted to not be compromised and/or malicious. Note that username/password authentication does not protect against this exploit, and servers using --client-cert-not-required by definition have no client certificates to protect against this exploit. In particular VPN service providers are affected, because anyone can get their hands on the necessary client certificates and TLS auth keys. """