Bug 1025870 (CVE-2013-6075)

Summary: CVE-2013-6075 strongswan: denial of service and potential authorization bypass
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: avagarwa, jkurik, pfrields, psimerda, pwouters
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: strongswan 5.1.1 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-02-23 15:56:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1025974, 1025975    
Bug Blocks: 1025873    

Description Vincent Danen 2013-11-01 19:16:06 UTC 
A denial of service vulnerability was discovered in strongSwan's IKDE daemon charon.  This flaw can be triggered by a crafted ID_DER_ASN1_DN ID payload and is caused by an insufficient length check when comparing such identities.  This could cause a memory read outside specified boundaries or a NULL dereference which would result in an IKE daemon crash.  As no write operation is performed, code injection is unlikely.

As well, with a crafted ID payload, an attacker could impersonate a different user and get access to VPN connection profiles the victim would have access to.  However, this would require that the attacker successfully authenticate with appropriate credentials, and as such upstream indicates that it seems quite difficult to construct such an attack, although it may be possible.

strongSwan 5.1.1 corrects this flaw.  A patch [1] is provided for older releases.  All versions since 4.3.3 are affected.

[1] http://download.strongswan.org/security/CVE-2013-6075/


External References:

http://strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-(cve-2013-6075).html
Comment 1 Vincent Danen 2013-11-02 16:59:07 UTC 
This issue does not affect libreswan or openswan.  The compare_dn() function that is affected does not exist in either libreswan or openswan, and the IKE fragmentation implementation is different, not including this vulnerable code.


Statement:

Not vulnerable. This issue did not affect the versions of openswan as shipped with Red Hat Enterprise Linux 5 and 6.
Comment 2 Vincent Danen 2013-11-02 16:59:49 UTC 
Created strongswan tracking bugs for this issue:

Affects: fedora-all [bug 1025974]
Affects: epel-6 [bug 1025975]
Comment 3 Fedora Update System 2014-01-25 02:25:56 UTC 
strongswan-5.1.1-4.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2014-01-25 02:26:55 UTC 
strongswan-5.1.1-4.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2014-01-25 05:09:20 UTC 
strongswan-5.1.1-4.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.