{"id":111480,"date":"2023-11-13T15:10:13","date_gmt":"2023-11-13T13:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-openvpn-i-softether-vpn"},"modified":"2023-11-13T15:10:13","modified_gmt":"2023-11-13T13:10:13","slug":"uyazvimosti-v-openvpn-i-softether-vpn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/no\/blog\/news\/uyazvimosti-v-openvpn-i-softether-vpn","title":{"rendered":"S\u00e5rbarheter i OpenVPN og SoftEther VPN","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Utgitt versjon OpenVPN 2.6.7, en pakke for opprettelse av virtuelle private nettverk som lar deg organisere en kryptert forbindelse mellom to klientmaskiner eller sette opp en sentralisert VPN-server for samtidig drift av flere klienter. I den nye versjonen er to s\u00e5rbarheter fikset:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-46850 \u2014 tilgang til minneomr\u00e5de etter at det er frigitt (use-after-free) kan f\u00f8re til sending av minneinnhold fra prosessen til en annen side av tilkoblingen, samt potensielt eksternt kodekj\u00f8ring. Problemet oppst\u00e5r i konfigurasjoner som bruker TLS (kj\u00f8rt uten parameteret \u00ab\u2014secret\u00bb).\n<li class=\"l\"> CVE-2023-46849 \u2014 oppst\u00e5else av en deling med null kan f\u00f8re til ekstern initiert krasj av tilgangsserveren i konfigurasjoner som bruker alternativet \u00ab\u2014fragment\u00bb.    <\/ul>\n<p>Av endringer som ikke er relatert til sikkerhet i OpenVPN 2.6.7:  <\/p>\n<ul>\n<li class=\"l\"> Lagt til advarsel n\u00e5r en annen part sender DATA_V1-pakker n\u00e5r klienten pr\u00f8ver \u00e5 koble til OpenVPN 2.6.x til inkompatible servere basert p\u00e5 versjoner 2.4.0-2.4.4 (for \u00e5 l\u00f8se inkompatibilitet kan alternativet \u00ab\u2014disable-dco\u00bb brukes).\n<li class=\"l\"> Fjernet den utdaterte metoden knyttet til OpenSSL 1.x som bruker OpenSSL Engine for \u00e5 laste n\u00f8kler. \u00c5rsaken som er oppgitt er forfatternes uvillighet til \u00e5 re-lisensiere koden med nye unntak for binding.\n<li class=\"l\"> Lagt til varsel ved tilkobling av p2p NCP klient til <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/no\/server\/dts-shicago\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2912\">server<\/a> p2mp (kombinasjonen som brukes for drift uten forhandling om chiffere), da det er problemer ved bruk av versjoner 2.6.x p\u00e5 begge sider av forbindelsen.\n<li class=\"l\"> Lagt til advarsel om at flagget \u00ab\u2014show-groups\u00bb ikke viser alle st\u00f8ttede grupper.\n<li class=\"l\"> I parameteret \u00ab\u2014dns\u00bb er behandlingen av argumentet \u00abexclude-domains\u00bb fjernet, som ble introdusert i versjon 2.6, men som fortsatt ikke st\u00f8ttes av backendene.\n<li class=\"l\"> Lagt til varsel som vises hvis kontrollmeldingen INFO har for stor st\u00f8rrelse og ikke kan videresendes til klienten.\n<li class=\"l\"> For bygg med MinGW og MSVC er st\u00f8tte for CMake byggesystem lagt til. St\u00f8tten for det gamle MSVC byggesystemet er fjernet.  <\/ul>\n<p>I tillegg kan man merke seg oppdagelsen av 9 s\u00e5rbarheter i \u00e5pen kildekode. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/no\/vpn\/\"   title=\"VPN\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"213\">VPN<\/a>-server SoftEther. En av problemene (CVE-2023-27395) er tildelt kritisk alvorlighetsgrad \u2014 s\u00e5rbarheten er for\u00e5rsaket av bufferoverl\u00f8p og kan f\u00f8re til eksternt kodekj\u00f8ring p\u00e5 klientsiden n\u00e5r man pr\u00f8ver \u00e5 koble til en server kontrollert av en angriper. S\u00e5rbarheten er rettet i junioppdateringen av SoftEther VPN 4.42 Build 9798 RTM. To andre s\u00e5rbarheter (CVE-2023-32634, CVE-2023-27516) gir mulighet for uautorisert tilgang til VPN-\u00f8kten under en MITM-angrep ved bruk av standard legitimasjon for RPC-serveren. S\u00e5rbarhetene er rettet i form av en patch.    <\/p>\n<p>S\u00e5rbarhetene CVE-2023-31192 og CVE-2023-32275 (patch) kan f\u00f8re til lekkasje av konfidensiell informasjon i visse pakker som et resultat av MITM-angrep. De resterende 4 s\u00e5rbarhetene (CVE-2023-22325, CVE-2023-23581, CVE-2023-22308 og CVE-2023-25774) kan brukes til \u00e5 for\u00e5rsake tjenestenekt, for eksempel ved \u00e5 tvinge oppbrudd av forbindelsen eller krasje klienten. Det ble nylig ogs\u00e5 akseptert en korreksjon av 7 s\u00e5rbarheter i kodebasen til SoftEther VPN, detaljer om disse er enn\u00e5 ikke tilgjengelige.<br \/>\n<br \/>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60103\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a OpenVPN 2.6.7, \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u043c\u0438 \u043c\u0430\u0448\u0438\u043d\u0430\u043c\u0438 \u0438\u043b\u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u043e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2023-46850 &#8212; \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u043a \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f (use-after-free) \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u043d\u0430 \u0434\u0440\u0443\u0433\u0443\u044e \u0441\u0442\u043e\u0440\u043e\u043d\u0443 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111480","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a OpenVPN 2.6.7, \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u043c\u0438 \u043c\u0430\u0448\u0438\u043d\u0430\u043c\u0438 \u0438\u043b\u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/no\/blog\/news\/uyazvimosti-v-openvpn-i-softether-vpn\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"nn_NO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenVPN \u0438 SoftEther VPN | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a OpenVPN 2.6.7, \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u043c\u0438 \u043c\u0430\u0448\u0438\u043d\u0430\u043c\u0438 \u0438\u043b\u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/no\/blog\/news\/uyazvimosti-v-openvpn-i-softether-vpn\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-11-13T13:10:13+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-11-13T13:10:13+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarheter i OpenVPN og SoftEther VPN | ProHoster","description":"Utgivelsen OpenVPN 2.6.7 er forberedt, et program for oppretting av virtuelle private nettverk, som muliggj\u00f8r kryptert tilkobling mellom to klientmaskiner eller muliggj\u00f8r drift av en sentralisert VPN-server.","canonical_url":"https:\/\/prohoster.info\/no\/blog\/news\/uyazvimosti-v-openvpn-i-softether-vpn","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nn_NO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenVPN \u0438 SoftEther VPN | ProHoster","og:description":"\u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a OpenVPN 2.6.7, \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u043c\u0438 \u043c\u0430\u0448\u0438\u043d\u0430\u043c\u0438 \u0438\u043b\u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e VPN-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/no\/blog\/news\/uyazvimosti-v-openvpn-i-softether-vpn","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-13T13:10:13+00:00","article:modified_time":"2023-11-13T13:10:13+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111480","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-04 14:42:23","updated":"2026-02-09 21:42:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/111480","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/comments?post=111480"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/111480\/revisions"}],"predecessor-version":[{"id":160192,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/111480\/revisions\/160192"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media?parent=111480"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/categories?post=111480"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/tags?post=111480"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}