A denial of service vulnerability was discovered in strongSwan's IKDE daemon charon. This flaw can be triggered by a crafted ID_DER_ASN1_DN ID payload and is caused by an insufficient length check when comparing such identities. This could cause a memory read outside specified boundaries or a NULL dereference which would result in an IKE daemon crash. As no write operation is performed, code injection is unlikely. As well, with a crafted ID payload, an attacker could impersonate a different user and get access to VPN connection profiles the victim would have access to. However, this would require that the attacker successfully authenticate with appropriate credentials, and as such upstream indicates that it seems quite difficult to construct such an attack, although it may be possible. strongSwan 5.1.1 corrects this flaw. A patch [1] is provided for older releases. All versions since 4.3.3 are affected. [1] http://download.strongswan.org/security/CVE-2013-6075/ External References: http://strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-(cve-2013-6075).html
This issue does not affect libreswan or openswan. The compare_dn() function that is affected does not exist in either libreswan or openswan, and the IKE fragmentation implementation is different, not including this vulnerable code. Statement: Not vulnerable. This issue did not affect the versions of openswan as shipped with Red Hat Enterprise Linux 5 and 6.
Created strongswan tracking bugs for this issue: Affects: fedora-all [bug 1025974] Affects: epel-6 [bug 1025975]
strongswan-5.1.1-4.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
strongswan-5.1.1-4.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
strongswan-5.1.1-4.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.