Vulnerabilities > CVE-2018-9336 - Double Free vulnerability in multiple products

047910
CVSS 4.6 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
local
low complexity
openvpn
slackware
CWE-415
nessus

Summary

openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation.

Common Weakness Enumeration (CWE)

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-705.NASL
    descriptionThis update for openvpn fixes the following issues : - CVE-2018-9336: Fix potential double-free() in Interactive Service could lead to denial of service (bsc#1090839). This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-05
    modified2018-07-09
    plugin id110961
    published2018-07-09
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110961
    titleopenSUSE Security Update : openvpn (openSUSE-2018-705)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2018-705.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(110961);
      script_version("1.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2018-9336");
      script_xref(name:"TRA", value:"TRA-2018-09");
    
      script_name(english:"openSUSE Security Update : openvpn (openSUSE-2018-705)");
      script_summary(english:"Check for the openSUSE-2018-705 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for openvpn fixes the following issues :
    
      - CVE-2018-9336: Fix potential double-free() in
        Interactive Service could lead to denial of service
        (bsc#1090839).
    
    This update was imported from the SUSE:SLE-15:Update update project."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1090839"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.tenable.com/security/research/tra-2018-09"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected openvpn packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openvpn");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openvpn-auth-pam-plugin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openvpn-auth-pam-plugin-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openvpn-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openvpn-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openvpn-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openvpn-down-root-plugin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:openvpn-down-root-plugin-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2018/07/06");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/09");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE15\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.0", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE15.0", reference:"openvpn-2.4.3-lp150.3.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"openvpn-auth-pam-plugin-2.4.3-lp150.3.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"openvpn-auth-pam-plugin-debuginfo-2.4.3-lp150.3.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"openvpn-debuginfo-2.4.3-lp150.3.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"openvpn-debugsource-2.4.3-lp150.3.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"openvpn-devel-2.4.3-lp150.3.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"openvpn-down-root-plugin-2.4.3-lp150.3.3.1") ) flag++;
    if ( rpm_check(release:"SUSE15.0", reference:"openvpn-down-root-plugin-debuginfo-2.4.3-lp150.3.3.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "openvpn / openvpn-auth-pam-plugin / etc");
    }
    
  • NASL familyWindows
    NASL idOPENVPN_2_4_6.NASL
    descriptionAccording to its self-reported version number, the version of OpenVPN installed on the remote Windows host is affected by a denial of service (DoS) vulnerability in its interactive service helper component due to an invalid level of validation for incoming requests. An unauthenticated, local attacker can exploit this issue, by sending malformed requests, to cause the application to stop responding.
    last seen2020-06-01
    modified2020-06-02
    plugin id125263
    published2019-05-17
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/125263
    titleOpenVPN 2.4.x < 2.4.6 Denial of Service Vulnerability (Windows)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2018-116-01.NASL
    descriptionNew openvpn packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue.
    last seen2020-06-01
    modified2020-06-02
    plugin id109362
    published2018-04-27
    reporterThis script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109362
    titleSlackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : openvpn (SSA:2018-116-01)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-507.NASL
    descriptionThis update for openvpn fixes the following issues : - CVE-2018-9336: Fix potential double-free() in Interactive Service could lead to denial of service (bsc#1090839). This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id123212
    published2019-03-27
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123212
    titleopenSUSE Security Update : openvpn (openSUSE-2019-507)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-1888-1.NASL
    descriptionThis update for openvpn fixes the following issues : - CVE-2018-9336: Fix potential double-free() in Interactive Service could lead to denial of service (bsc#1090839). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-21
    modified2019-01-02
    plugin id120034
    published2019-01-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/120034
    titleSUSE SLED15 / SLES15 Security Update : openvpn (SUSE-SU-2018:1888-1)