CVE-2024-3661

{"id": "CVE-2024-3661", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "published": "2024-05-06T19:15:11.027", "references": [{"url": "https://arstechnica.com/security/2024/05/novel-attack-against-virtually-all-vpn-apps-neuters-their-entire-purpose/", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://datatracker.ietf.org/doc/html/rfc2131#section-7", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://datatracker.ietf.org/doc/html/rfc3442#section-7", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://issuetracker.google.com/issues/263721377", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://lowendtalk.com/discussion/188857/a-rogue-dhcp-server-within-your-network-can-and-will-hijack-your-vpn-traffic", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://news.ycombinator.com/item?id=40279632", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://news.ycombinator.com/item?id=40284111", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://tunnelvisionbug.com/", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://www.agwa.name/blog/post/hardening_openvpn_for_def_con", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://www.leviathansecurity.com/research/tunnelvision", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://www.theregister.com/2024/05/07/vpn_tunnelvision_dhcp/", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability", "source": "9119a7d8-5eab-497f-8521-727c672e3725"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-501"}]}], "descriptions": [{"lang": "en", "value": "DHCP can add routes to a client\u2019s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN."}, {"lang": "es", "value": "Por dise\u00f1o, el protocolo DHCP no autentica mensajes, incluida, por ejemplo, la opci\u00f3n de ruta est\u00e1tica sin clases (121). Un atacante con la capacidad de enviar mensajes DHCP puede manipular rutas para redirigir el tr\u00e1fico VPN, lo que le permite leer, interrumpir o posiblemente modificar el tr\u00e1fico de red que se esperaba que estuviera protegido por la VPN. Muchos, si no la mayor\u00eda, de los sistemas VPN basados en enrutamiento IP son susceptibles a este tipo de ataques."}], "lastModified": "2024-05-08T22:15:49.103", "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725"}