VPN-busting bug in iOS, Android, Linux distros, macOS, FreeBSD, OpenBSD. AirVPN affected ?

[aquarius 0]

Hi,
I just heard about this new VPN vulnerability:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14899
https://www.theregister.co.uk/2019/12/06/vpnbusting_bug_spotted/
 

Quote

Tricky VPN-busting bug lurks in iOS, Android, Linux distros, macOS, FreeBSD, OpenBSD, say university eggheads
OpenVPN, WireGuard, IKEv2/IPSec also vulnerable to tampering flaw, we're told

A bug in the way Unix-flavored systems handle TCP connections could put VPN users at risk of having their encrypted traffic hijacked, it is claimed.

Should I be worried, is AirVPN affected by this ?

[Staff 9973]

Hello!

Let's see the paper first. It will be published after the vulnerability has been patched.

A paragraph from The Register says: ""This vulnerability works against OpenVPN, WireGuard, and IKEv2/IPSec, but has not been thoroughly tested against tor, but we believe it is not vulnerable since it operates in a SOCKS layer and includes authentication and encryption that happens in userspace," which is enigmatic because OpenVPN works in the userspace too, with encryption handled by OpenSSL or mbedTLS libraries.

EDIT: however, tun interface lives in the kernel space.

Kind regards
 

[SurprisedItWorks 49]

I'm no expert, but it looks like the "issue" does not depend on who your VPN provider is.  It also looks like the attacker would have to be inside your local network.  Generally it looks like the attack is so complicated and unlikely that it reminds me of an unfortunate fellow I know who has OCD, obsessive-compulsive disorder, who became obsessed with the fact that while walking home from a convenience store, a falling leaf had touched the straw of the drink he was carrying.  He became afraid to drink further because of the hypothetical possibility that a raccoon might have stepped on the leaf, and that raccoon may have had a particular parasite infection that raccoons can carry, and that an egg of the parasite might have been on the raccoon's foot, might have transferred to the leaf, and might have ended up on his straw, and might infect him if he drank further.  Was the scenario he was worried over impossible?  No, it was not.  But was it something he needed to worry about?