Microsoft researchers discovered multiple vulnerabilities in OpenVPN, allowing attackers to chain remote code execution and local privilege escalation attacks on various platforms.
These vulnerabilities, affecting all versions prior to 2.6.10 and 2.5.10, could grant attackers full control over compromised devices, potentially leading to data breaches and system compromise.
OpenVPN is an open-source VPN system employing SSL/TLS encryption for secure point-to-point and site-to-site connections, whose widespread adoption across industries and platforms underscores its popularity.
To enhance enterprise security, a vulnerability analysis was conducted on OpenVPN and other VPN solutions, revealing a critical flaw, CVE-2024-1305, affecting multiple VPN drivers.
Subsequent investigation into OpenVPN’s architecture and security model for Windows systems was initiated to identify and address potential vulnerabilities.
OpenVPN’s client architecture comprises a user-mode process, openvpn.exe, and a system service, openvpnserv.exe, communicating via named pipes.
The user-mode process handles configuration loading and tunnel establishment, while the system service, operating with elevated privileges, manages network interactions like DNS configuration, IP address assignment, and route manipulation.
These components work in tandem to create a secure VPN tunnel, with openvpnserv.exe also responsible for spawning new openvpn.exe instances as needed.
OpenVPN’s plugin mechanism extends functionality through loaded directives, enabling integration of authentication backends like LDAP, Radius, or PAM. Plugins are invoked via callbacks triggered by OpenVPN.
The client-side architecture involves openvpnserv spawning user-contextual openvpn.exe processes using named pipe impersonation. Rigorous access controls and elevated command restrictions safeguard against malicious activity, ensuring process integrity within the user’s security context.
The `tap-windows6` project contains a vulnerability where attacker-controlled `PacketLength` and `PrefixLength` parameters within the `TapDeviceWrite` function can overflow a 32-bit unsigned integer when summed to calculate `fullLength`.
This integer overflow leads to the allocation of insufficient memory in `NdisAllocateNetBufferAndNetBufferLists`, resulting in a subsequent memory overflow, potentially enabling further exploitation.
CVE-2024-27459 arises from a flawed communication mechanism between openvpn.exe and openvpnserv.exe. The latter reads message sizes from the former in a loop and subsequently processes the data.
A critical oversight exists: the service blindly trusts the provided message size and allocates a corresponding stack-based buffer, rendering the application susceptible to a stack overflow attack if an oversized value is received.
OpenVPN vulnerabilities CVE-2024-24974 and CVE-2024-27903 allow attackers to achieve remote code execution (RCE) and local privilege escalation (LPE) by exploiting unprivileged access to the named pipe “\\openvpn\service” and loading malicious plugins from arbitrary locations.
By chaining these vulnerabilities with credential theft, attackers can remotely interact with the OpenVPN service, launch new OpenVPN instances with malicious configurations, and ultimately execute code or elevate privileges on the target system.
Researchers at Microsoft discovered multiple vulnerabilities in OpenVPN that could be chained to achieve Remote Code Execution (RCE) and Local Privilege Escalation (LPE).
Successful exploitation would grant attackers full control over affected endpoints, enabling data theft, tampering, or destruction. While complex to execute, the potential impact is severe for both private and enterprise environments.
Immediate patching of OpenVPN to version 2.5.10 or 2.6.10 is crucial, while additional mitigation measures include network segmentation, access control, and strong password policies.
.webp?w=1200&resize=1200,0&ssl=1 "New Bluetooth Vulnerability Lets MITM Attackers Find The Passkey While Pairing")
