The release of OpenVPN 2.6.13 has been published, allowing for the establishment of an encrypted connection between two client machines or for the operation of a centralized VPN server that supports multiple clients simultaneously. The new version addresses a security issue that can lead to a buffer overflow on the OpenVPN server side when receiving a login or password from a client that exceeds the USER_PASS_LEN value. A CVE identifier for the vulnerability has not yet been assigned, and it's unclear how exploitable the issue is.
Among the non-security-related changes to note:
- The client can now send the IV_PLAT_VER parameter, which contains information about the operating system release provided by the uname() function, enabling the collection of statistics about the OS versions used by clients. servers collect statistics on the operating system versions used by clients.
- On Linux systems, the systemd-ask-password process can now be started with the parameter '—timeout=0' to disable the default 90-second timeout.
- Memory leaks observed in FreeBSD have been fixed.
- When started with the '—auth-nocache' option, authentication parameters for the proxy are now removed from memory after use.
- In the Windows client, the CryptProtectMemory() function has been implemented for securely storing cached passwords and tokens in memory. A new API has been utilized to obtain the version of the dco-win driver.
Source: opennet.ru
