VTun-ng Encryption Initialization Vulnerability Leading to Plaintext Reversion

A vulnerability in VTun-ng, a Virtual Tunnel over TCP/IP network, allows for a reversion to plaintext due to a failure in properly initializing encryption modules. This issue, present in versions prior to 3.0.18, was introduced in version 3.0.12 and arises from inadequate error handling. When the blowfish-256 encryption is used, the problem is guaranteed to occur.

Impact

The vulnerability can lead to sensitive data being transmitted in plaintext, potentially exposing it to interception or unauthorized access.

Remediation

Users are advised to upgrade to VTun-ng version 3.0.18. In the meantime, avoid using blowfish-256 encryption.