1. CVE-Search
  2. CVE-2018-9336
ID CVE-2018-9336
Summary openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation.
References
Vulnerable Configurations
  • cpe:2.3:a:openvpn:openvpn:2.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.4.0:-:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.0:-:*:*:*:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.4.0:alpha1:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.0:alpha1:*:*:*:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.4.0:alpha2:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.0:alpha2:*:*:*:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.4.0:beta1:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.0:beta1:*:*:*:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.4.0:beta2:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.0:beta2:*:*:*:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.4.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.4.0:rc2:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.0:rc2:*:*:*:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:openvpn:openvpn:2.4.5:*:*:*:*:*:*:*
  • cpe:2.3:o:slackware:slackware_linux:13.0:*:*:*:*:*:*:*
    cpe:2.3:o:slackware:slackware_linux:13.0:*:*:*:*:*:*:*
  • cpe:2.3:o:slackware:slackware_linux:13.1:*:*:*:*:*:*:*
    cpe:2.3:o:slackware:slackware_linux:13.1:*:*:*:*:*:*:*
  • cpe:2.3:o:slackware:slackware_linux:13.37:*:*:*:*:*:*:*
    cpe:2.3:o:slackware:slackware_linux:13.37:*:*:*:*:*:*:*
  • cpe:2.3:o:slackware:slackware_linux:14.0:*:*:*:*:*:*:*
    cpe:2.3:o:slackware:slackware_linux:14.0:*:*:*:*:*:*:*
  • cpe:2.3:o:slackware:slackware_linux:14.1:*:*:*:*:*:*:*
    cpe:2.3:o:slackware:slackware_linux:14.1:*:*:*:*:*:*:*
CVSS
Base: 4.6 (as of 13-06-2018 - 14:27)
Impact:
Exploitability:
CWE CWE-415
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:L/AC:L/Au:N/C:P/I:P/A:P
refmap via4
confirm
misc https://www.tenable.com/security/research/tra-2018-09
slackware SSA:2018-116-01
Last major update 13-06-2018 - 14:27
Published 01-05-2018 - 18:29
Last modified 13-06-2018 - 14:27
Back to Top