OpenVPN Command Injection Vulnerability via DNS Variables in Updown Scripts

A command injection vulnerability has been identified in OpenVPN versions 2.7_alpha1 through 2.7_beta1 on POSIX-based platforms. This vulnerability allows a remote authenticated server to inject shell commands by exploiting DNS variables, but only when the '--dns-updown' option is active.

Impact

Exploitation of this vulnerability could lead to arbitrary command execution on the affected system.

Remediation

Users can upgrade to OpenVPN 2.7_beta2, which includes proper input sanitation for DNS strings to mitigate this vulnerability. This version is available for download from the OpenVPN community downloads page, and packages for various Linux distributions can be found in the official OpenVPN community repositories.