Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 111116 - net-misc/openvpn: format string and DoS vulnerabilities
Summary: net-misc/openvpn: format string and DoS vulnerabilities
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
Whiteboard: B2 [glsa]
Depends on: 111267
  Show dependency tree
Reported: 2005-11-01 03:16 UTC by Guillaume Castagnino
Modified: 2005-11-06 10:44 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Guillaume Castagnino 2005-11-01 03:16:32 UTC
Looking at this advisory :
OpenVPN <= 2.0.2 has 2 vulnerabilities.
Please bump to 2.0.3 as quick as possible

Comment 1 Thierry Carrez (RETIRED) gentoo-dev 2005-11-01 03:54:53 UTC
Ccing rest of herd as luckyduck has been away for some time. Please bump to 2.0.3.
Comment 2 Roy Marples (RETIRED) gentoo-dev 2005-11-01 04:59:33 UTC
Adding myself as I've been looking after openvpn due to a (now solved)
baselayout-1.12.0_pre issue as luckyduck is away (for long time) and warpzero is
no longer a dev (iirc)

Koon, openvpn-2.0.3 isn't released yet and has no source tarball or any 2.0.3
download available from their site.
Comment 3 Thierry Carrez (RETIRED) gentoo-dev 2005-11-01 05:50:04 UTC
They pulled the release, probably needs a small last-minute fix.
Comment 4 Sebastian Siewior 2005-11-01 12:53:14 UTC
Are we talking abour 2.0.3 or 2.0.4 ?
Comment 5 Sebastian Siewior 2005-11-01 12:54:46 UTC
Are we talking abour 2.0.3 or 2.0.4 ?
Comment 6 Guillaume Castagnino 2005-11-01 13:02:57 UTC
OK, 2.0.3 was released this morning then removed a few hours after...
Now 2.0.4 is released with the correct fixes (see

So now bump is for 2.0.4 skipping 2.0.3 ;)
Comment 7 Roy Marples (RETIRED) gentoo-dev 2005-11-02 04:24:31 UTC
2.0.4 is now in the tree
Comment 8 Thierry Carrez (RETIRED) gentoo-dev 2005-11-02 04:34:03 UTC
Arches please test and mark 2.0.4 stable
Target KEYWORDS="alpha amd64 ppc ppc-macos sparc x86"
Comment 9 Andrej Kacian (RETIRED) gentoo-dev 2005-11-02 06:52:45 UTC
x86 stable
Comment 10 Michael Hanselmann (hansmi) (RETIRED) gentoo-dev 2005-11-02 10:10:37 UTC
Stable on ppc.
Comment 11 Roy Marples (RETIRED) gentoo-dev 2005-11-02 10:26:21 UTC
2.0.4 removed as to having the new init script
2.0.4-r1 added with old script - please mark this version stable
2.0.4-r2 has the new init script

Sorry for any confusion/problems/whatever
Comment 12 Fabian Groffen gentoo-dev 2005-11-02 12:14:18 UTC
2.0.4-r1 stable on ppc-macos
Comment 13 Gustavo Zacarias (RETIRED) gentoo-dev 2005-11-03 06:05:50 UTC
sparc stable.
Comment 14 Roy Marples (RETIRED) gentoo-dev 2005-11-03 10:08:03 UTC
openvpn-2.0.5 just got released with fixes another serious issue
I've just comitted it to the tree, fixing bug #111369, marked ~ARCH

The 2.0.4 ebuilds are still there, but are un-useable on Linux.
ChangeLog snippet

* Fixed bug in Linux get_default_gateway function
  introduced in 2.0.4, which would cause redirect-gateway
  on Linux clients to fail.
* Restored easy-rsa/2.0 tree (backported from 2.1 beta
  series) which accidentally disappeared in
  2.0.2 -> 2.0.4 transition.

I'll leave it upto you guys if you want to stable 2.0.5 as technically 2.0.4 has
the security fix but as the openvpn guys said, it may be unuseable.
Comment 15 Roy Marples (RETIRED) gentoo-dev 2005-11-03 10:09:56 UTC
Uh - if this goes stable, then mark 2.0.5 stable and NOT 2.0.5-r1 which has the
new init script
Comment 16 Thierry Carrez (RETIRED) gentoo-dev 2005-11-03 10:52:16 UTC
We should definitely have 2.0.5 stable rather than 2.0.4...

Upstream really fucked up this release big time.
Readding arches that already tested 2.0.4...
Comment 17 Michael Hanselmann (hansmi) (RETIRED) gentoo-dev 2005-11-03 11:15:02 UTC
Stable on ppc.
Comment 18 Mark Loeser (RETIRED) gentoo-dev 2005-11-03 21:53:10 UTC
x86 done
Comment 19 Fabian Groffen gentoo-dev 2005-11-04 03:14:51 UTC
ppc-macos done
Comment 20 Gustavo Zacarias (RETIRED) gentoo-dev 2005-11-04 06:45:15 UTC
sparc stable, let's hope it's the last one.
Comment 21 Bryan Østergaard (RETIRED) gentoo-dev 2005-11-05 05:38:38 UTC
Alpha stable.
Comment 22 Simon Stelling (RETIRED) gentoo-dev 2005-11-06 04:40:45 UTC
amd64 stable, sorry for the delay
Comment 23 Thierry Carrez (RETIRED) gentoo-dev 2005-11-06 10:44:56 UTC
GLSA 200511-07