OpenVPN 2.x before 2.0.4 when running in TCP mode allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status which leads to a null dereference in an exception handler.