CVE-2008-3459
Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via crafted (1) lladdr and (2) iproute configuration directives, probably related to shell metacharacters.
- CVSS 2.0
- 7.6 HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
- EPSS
- 2.12% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-16
- Affected
- openvpn/openvpn
- Source
- secalert@redhat.com
References
- http://openvpn.net/index.php/documentation/change-log/changelog-21.html
- http://www.securityfocus.com/bid/30532
- http://www.securitytracker.com/id?1020626
- http://www.vupen.com/english/advisories/2008/2316Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44209
- http://openvpn.net/index.php/documentation/change-log/changelog-21.html
- http://www.securityfocus.com/bid/30532
- http://www.securitytracker.com/id?1020626
- http://www.vupen.com/english/advisories/2008/2316Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44209
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.