{"id":121283,"date":"2025-01-09T15:46:01","date_gmt":"2025-01-09T13:46:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-openvpn-dopuskayushhaya-podstanovku-dannyh-v-plaginy-i-storonnie-obrabotchiki"},"modified":"2025-01-09T15:46:01","modified_gmt":"2025-01-09T13:46:01","slug":"uyazvimost-v-openvpn-dopuskayushhaya-podstanovku-dannyh-v-plaginy-i-storonnie-obrabotchiki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-openvpn-dopuskayushhaya-podstanovku-dannyh-v-plaginy-i-storonnie-obrabotchiki","title":{"rendered":"Vuln\u00e9rabilit\u00e9 dans OpenVPN, permettant l'injection de donn\u00e9es dans des plugins et des gestionnaires externes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Des informations sur la vuln\u00e9rabilit\u00e9 (CVE-2024-5594) dans le package de cr\u00e9ation de r\u00e9seaux priv\u00e9s virtuels OpenVPN ont \u00e9t\u00e9 r\u00e9v\u00e9l\u00e9es, ce qui peut conduire \u00e0 l'injection de donn\u00e9es arbitraires dans des fichiers ex\u00e9cutables ou des plugins tiers sur le syst\u00e8me de l'autre c\u00f4t\u00e9 de la connexion. La vuln\u00e9rabilit\u00e9 est caus\u00e9e par l'absence de v\u00e9rification de la pr\u00e9sence de z\u00e9ros et de caract\u00e8res incorrects lors du traitement des messages de contr\u00f4le, tels que PUSH_REPLY. <\/p>\n

Le probl\u00e8me a \u00e9t\u00e9 r\u00e9solu dans les versions OpenVPN 2.5.11 et 2.6.11, publi\u00e9es en juin 2024. Dans les notes de version, la vuln\u00e9rabilit\u00e9 \u00e9tait consid\u00e9r\u00e9e comme un probl\u00e8me mineur, entra\u00eenant l'enregistrement de donn\u00e9es corrompues dans le journal ou une augmentation de la charge CPU. Dans la mise \u00e0 jour publi\u00e9e il y a quelques jours, le probl\u00e8me a \u00e9t\u00e9 class\u00e9 comme critique (niveau de danger 9.1 sur 10). <\/p>\n

Les d\u00e9tails de l'exploitation ne sont pas encore fournis. La correction se limite \u00e0 l'arr\u00eat du traitement des messages contenant des caract\u00e8res incorrects et \u00e0 la v\u00e9rification des caract\u00e8res incorrects dans l'ensemble du tampon, et non seulement dans la partie jusqu'au byte nul. La v\u00e9rification des caract\u00e8res sp\u00e9ciaux et du byte nul a \u00e9t\u00e9 ajout\u00e9e pour les commandes «AUTH_FAILED», «PUSH_*», «RESTART», «HALT», «INFO_PRE», «INFO», «CR_RESPONSE», «AUTH_PENDING» et «EXIT».
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2024-5594) \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 OpenVPN, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438\u043b\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043d\u0430 \u0434\u0440\u0443\u0433\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u043d\u0443\u043b\u0435\u0432\u044b\u0445 \u0431\u0430\u0439\u0442\u043e\u0432 \u0438 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u0445 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a PUSH_REPLY. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 OpenVPN 2.5.11 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121283","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 dans OpenVPN permettant l'injection de donn\u00e9es dans des plugins et des gestionnaires tiers | ProHoster","description":"Des informations sur la vuln\u00e9rabilit\u00e9 (CVE-2024-5594) dans le package de cr\u00e9ation de r\u00e9seaux priv\u00e9s virtuels OpenVPN ont \u00e9t\u00e9 r\u00e9v\u00e9l\u00e9es, ce qui peut conduire \u00e0 l'injection de donn\u00e9es arbitraires dans des fichiers ex\u00e9cutables ou des plugins tiers dans le syst\u00e8me.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-openvpn-dopuskayushhaya-podstanovku-dannyh-v-plaginy-i-storonnie-obrabotchiki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenVPN, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u044b \u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2024-5594) \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 OpenVPN, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438\u043b\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-openvpn-dopuskayushhaya-podstanovku-dannyh-v-plaginy-i-storonnie-obrabotchiki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-09T13:46:01+00:00","article:modified_time":"2025-01-09T13:46:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121283","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 09:31:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:31:19","updated":"2026-01-23 09:31:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121283","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=121283"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121283\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=121283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=121283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=121283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}