known vulnerabilities

[Xavier Poinsard]

Several vulnerabilites where fixed upstream and made their way to Debian.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324167

[Jason Lunz (lunz)]

Tags: patch

split-out patches for each of the addressed issues are available at:
http://openvpn.net/patch/2.0.1-security-patches/

Jason

[Micah Anderson (micah-debian)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

When you fix this, please mention the CAN numbers fixed in the upload
changelog. This helps the testing-security team track these.

Additionally, if a fix for openvpn in testing is blocked by other
elements, please contact the testing-security team for aid in getting a
DTSA and the fix moved into testing.

Thanks,
micah
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDD7O19n4qXRzy1ioRApGYAJ0ee16UGZkcrx4X/IPsOzhlTSRFgQCcDGYQ
tgCtsfJsJLfHDAg1cDw/rHo=
=MJrl
-----END PGP SIGNATURE-----

[Alberto Gonzalez Iniesta (agi-inittab)]

Source: openvpn
Source-Version: 2.0.2-1

We believe that the bug you reported is fixed in the latest version of
openvpn, which is due to be installed in the Debian FTP archive:

openvpn_2.0.2-1.diff.gz
  to pool/main/o/openvpn/openvpn_2.0.2-1.diff.gz
openvpn_2.0.2-1.dsc
  to pool/main/o/openvpn/openvpn_2.0.2-1.dsc
openvpn_2.0.2-1_i386.deb
  to pool/main/o/openvpn/openvpn_2.0.2-1_i386.deb
openvpn_2.0.2.orig.tar.gz
  to pool/main/o/openvpn/openvpn_2.0.2.orig.tar.gz

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alberto Gonzalez Iniesta <email address hidden> (supplier of updated openvpn package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sun, 28 Aug 2005 13:05:49 +0200
Source: openvpn
Binary: openvpn
Architecture: source i386
Version: 2.0.2-1
Distribution: unstable
Urgency: low
Maintainer: Alberto Gonzalez Iniesta <email address hidden>
Changed-By: Alberto Gonzalez Iniesta <email address hidden>
Description:
 openvpn - Virtual Private Network daemon
Closes: 309787 309944 312371 316139 317987 323594 324167
Changes:
 openvpn (2.0.2-1) unstable; urgency=low
 .
   * The [VAC] upload. Thanks Vorbis Gdynia for the free internet access :)
   * New upstream release (Closes: #323594)
   * Fixed use of backslash in username authentication. (Closes: #309787)
   * Fixes several DoS vulnerabilities: CAN-2005-2531 CAN-2005-2532
     CAN-2005-2533 CAN-2005-2534. (Closes: #324167)
   * Changed group option from 'nobody' to 'nogroup' in all the
     *example* files... (Closes: #317987)
   * Included openvpn-plugin.h to allow building third party plugins.
     (Closes: #316139)
   * Stop openvpn's daemon later to allow some services stopping later to use
     it. Added debconf template to ask permission to make the change
     on older installations. (Closes: #312371)
   * Workaround to fix proper daemonize when 'log' option is used.
     (Closes: #309944) Thanks Jason Lunz for the patch.
   * Modified output of init.d script to make it more friendly when
     passphrase for a tunnel certificate is asked.
     Thanks Pavel Vávra for the patch.
Files:
 33cba9bbc6d3c8691eaceac3f929638f 623 net optional openvpn_2.0.2-1.dsc
 862f8788f080f669b1ae00a74ef68001 663246 net optional openvpn_2.0.2.orig.tar.gz
 d5dbf77eea303a4b78b6e09d12ec8fd6 51411 net optional openvpn_2.0.2-1.diff.gz
 e2bef6b8a9be66dc13ffe345ce019ac2 317300 net optional openvpn_2.0.2-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDEbIZxRSvjkukAcMRAoNWAJ9EFt3zRuFavfmnbFsw4I9KCaKNtQCfZf4g
15FFPYKSAxVI/cIcrEclrrE=
=WunN
-----END PGP SIGNATURE-----

[Florian Weimer (fw)]

tags 324167 sarge

[Xavier Poinsard (xpoinsard)]

Several vulnerabilites where fixed upstream and made their way to Debian.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=324167

[Ante Karamatić (ivoks)]

Bug is being fixed....

[Ante Karamatić (ivoks)]

Fixed in breezy, fixes for hoary and warty are pending upload.