Bug 1050277 (CVE-2013-6466)

Summary: CVE-2013-6466 openswan: dereferencing missing IKEv2 payloads causes pluto daemon to restart
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amarecek, jkurik, kseifried, mkolaja, mrogers, nobody, pwouters, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-06-10 20:13:47 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1050322, 1050325, 1050337, 1050340, 1058402    
Bug Blocks: 1050315    
Attachments:
Description Flags
plutodebug=all log none

Description Kurt Seifried 2014-01-08 21:44:19 UTC 
Paul Wouters of Red Hat reports:

The Openswan Project was notified by Iustina Melinte of a vulnerability
regarding dereferencing of non-received IKEv2 payloads. This allows
a malicious non-authenticated remote user to cause a denial of service 
in the Openswan IKE daemon that can also cause existing VPN connections 
to drop.

Vulnerability information
--------------------------

Iustina Melinte used a custom IKE fuzzer to test Openswan. By withholding
or renumbering certain IKEv2 payloads, the pluto IKE daemon crashes while
trying to dereference a NULL pointer on the presumably received payload.

Note: by default, the use of IKEv2 payloads is set to 'permit', "signifying
no IKEv2 should be transmitted, but will be accepted if the other ends
initiates to us with IKEv2" (man ipsec.conf). Configurations that only
allow IKEv1 payloads (where "ikev2=" is set to 'never' or 'no' in the
ipsec.conf file) are not vulnerable.

Credits
--------

This vulnerability was found by Iustina Melinte.
Comment 4 Vincent Danen 2014-01-27 16:56:52 UTC 
External References:

https://libreswan.org/security/CVE-2013-6467/CVE-2013-6467.txt
Comment 5 Vincent Danen 2014-01-27 17:43:06 UTC 
Created openswan tracking bugs for this issue:

Affects: fedora-all [bug 1058402]
Comment 6 Paul Wouters 2014-01-27 17:46:24 UTC 
we don't ship openswan in fedora anymore. The packages have been obsoleted by the libreswan packages. We cannot do any more fedora openswan packages.
Comment 9 Paul Wouters 2014-02-18 15:06:42 UTC 
Note that openswan-2.6.40 did not properly fix this issue, as they did not use the backported libreswan patch we provided them. So while openswan 2.6.40 will get a new CVE number for this issue, our packages for errata RHSA-2014:0185 are not vulnerable.
Comment 10 errata-xmlrpc 2014-02-18 17:57:37 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 5

Via RHSA-2014:0185 https://rhn.redhat.com/errata/RHSA-2014-0185.html
Comment 11 Vincent Danen 2014-02-18 21:51:15 UTC 
A CVE for upstream openswan will be assigned soon, as this CVE was not fully fixed in the upstream release.  The Red Hat packages, however, used the correct patch and thus fully fixed the issue.
Comment 12 Paul Wouters 2014-02-20 16:14:57 UTC 
CVE-2014-2037 is assigned to openswan-2.6.41. And to confirm, our release from RHSA-2014:0185 is not vulnerable
Comment 13 Paul Wouters 2014-02-20 16:18:30 UTC 
CVE-2014-2037 is assigned to openswan-2.6.40
Comment 16 Ruslan Bors 2014-02-26 09:56:13 UTC 
Created attachment 867908 [details]
plutodebug=all log