OpenVPN Local Denial-of-Service Vulnerability in Windows Interactive Service

A denial-of-service vulnerability has been identified in OpenVPN versions 2.5.0 through 2.7_rc2 on Windows. The issue allows a local authenticated user to connect to the interactive service agent and trigger an error that causes a local denial-of-service condition. After the error occurs, OpenVPN connections will fail until the service is restarted or the system is rebooted.

Impact

Exploitation of this vulnerability leads to a local denial-of-service condition, causing OpenVPN connections to fail until the service is manually restarted or the system is rebooted.

Remediation

Users can upgrade to OpenVPN 2.7_rc3, which addresses this vulnerability. The source code and Windows installers are available on the OpenVPN community downloads page. Packages for Debian, Ubuntu, Fedora, RHEL, and openSUSE can be obtained from the official OpenVPN community repositories.