Bug 1025870 - (CVE-2013-6075) CVE-2013-6075 strongswan: denial of service and potential authorization bypass
CVE-2013-6075 strongswan: denial of service and potential authorization bypass
Status: CLOSED CURRENTRELEASE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20131101,repor...
: Security
Depends On: 1025974 1025975
Blocks: 1025873
  Show dependency treegraph
 
Reported: 2013-11-01 15:16 EDT by Vincent Danen
Modified: 2014-02-23 10:56 EST (History)
6 users (show)

See Also:
Fixed In Version: strongswan 5.1.1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-02-23 10:56:35 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2013-11-01 15:16:06 EDT
A denial of service vulnerability was discovered in strongSwan's IKDE daemon charon.  This flaw can be triggered by a crafted ID_DER_ASN1_DN ID payload and is caused by an insufficient length check when comparing such identities.  This could cause a memory read outside specified boundaries or a NULL dereference which would result in an IKE daemon crash.  As no write operation is performed, code injection is unlikely.

As well, with a crafted ID payload, an attacker could impersonate a different user and get access to VPN connection profiles the victim would have access to.  However, this would require that the attacker successfully authenticate with appropriate credentials, and as such upstream indicates that it seems quite difficult to construct such an attack, although it may be possible.

strongSwan 5.1.1 corrects this flaw.  A patch [1] is provided for older releases.  All versions since 4.3.3 are affected.

[1] http://download.strongswan.org/security/CVE-2013-6075/


External References:

http://strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-(cve-2013-6075).html
Comment 1 Vincent Danen 2013-11-02 12:59:07 EDT
This issue does not affect libreswan or openswan.  The compare_dn() function that is affected does not exist in either libreswan or openswan, and the IKE fragmentation implementation is different, not including this vulnerable code.


Statement:

Not vulnerable. This issue did not affect the versions of openswan as shipped with Red Hat Enterprise Linux 5 and 6.
Comment 2 Vincent Danen 2013-11-02 12:59:49 EDT
Created strongswan tracking bugs for this issue:

Affects: fedora-all [bug 1025974]
Affects: epel-6 [bug 1025975]
Comment 3 Fedora Update System 2014-01-24 21:25:56 EST
strongswan-5.1.1-4.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2014-01-24 21:26:55 EST
strongswan-5.1.1-4.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2014-01-25 00:09:20 EST
strongswan-5.1.1-4.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.