Security Advisory

Security Update Advisory for TunnelVision Attack (CVE-2024-3661)

  • May 09 2024

Overview

 

A mitigation has been released to address the vulnerability caused by the TunnelVision attack. users of affected products should take action based on the mitigations.

 

Affected Products

 

Operating systems that follow the RFC specification for DHCP clients and have DHCP option 121 route support are vulnerable, potentially affecting Windows, Linux, Mac OS, and iOS.

 

Resolved Vulnerabilities

 

Vulnerability that could allow an attacker to bypass VPN encapsulation using a built-in feature in DHCP and send the target user’s traffic outside the VPN tunnel (CVE-2024-3661)

 

mitigation Measures

 

Please follow the instructions on the Referenced Sites to apply mitigations.

  • enable DHCP snooping, ARP protection, and port security on switches used for communication, and ignore the DHCP 121 option when using VPNs.

 

Referenced Sites

 

[1] CVE-2024-3661, a.k.a. TunnelVision, Exposes a VPN Bypass Vulnerability
https://www.zscaler.com/blogs/security-research/cve-2024-3661-k-tunnelvision-exposes-vpn-bypass-vulnerability

[2] CVE-2024-3661 Detail
https://nvd.nist.gov/vuln/detail/CVE-2024-3661

Tags:

Previous Post

Next Post