oss-security - Re: CVE request: OpenVPN (client) 2.1-beta14 through 2.1-rc8

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Mon, 4 Aug 2008 14:48:29 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: CVE request: OpenVPN (client) 2.1-beta14 through
 2.1-rc8

======================================================
Name: CVE-2008-3459
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3459
Reference: CONFIRM:http://openvpn.net/index.php/documentation/change-log/changelog-21.html

Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when
running on non-Windows systems, allows remote servers to execute
arbitrary commands via crafted (1) "lladdr" and (2) "iproute"
configuration directives, probably related to shell metacharacters.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.