Bug 1025870 (CVE-2013-6075) - CVE-2013-6075 strongswan: denial of service and potential authorization bypass
Summary: CVE-2013-6075 strongswan: denial of service and potential authorization bypass
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2013-6075
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1025974 1025975
Blocks: 1025873
TreeView+ depends on / blocked
 
Reported: 2013-11-01 19:16 UTC by Vincent Danen
Modified: 2021-02-17 07:13 UTC (History)
5 users (show)

Fixed In Version: strongswan 5.1.1
Clone Of:
Environment:
Last Closed: 2014-02-23 15:56:35 UTC
Embargoed:


Attachments (Terms of Use)

Description Vincent Danen 2013-11-01 19:16:06 UTC
A denial of service vulnerability was discovered in strongSwan's IKDE daemon charon.  This flaw can be triggered by a crafted ID_DER_ASN1_DN ID payload and is caused by an insufficient length check when comparing such identities.  This could cause a memory read outside specified boundaries or a NULL dereference which would result in an IKE daemon crash.  As no write operation is performed, code injection is unlikely.

As well, with a crafted ID payload, an attacker could impersonate a different user and get access to VPN connection profiles the victim would have access to.  However, this would require that the attacker successfully authenticate with appropriate credentials, and as such upstream indicates that it seems quite difficult to construct such an attack, although it may be possible.

strongSwan 5.1.1 corrects this flaw.  A patch [1] is provided for older releases.  All versions since 4.3.3 are affected.

[1] http://download.strongswan.org/security/CVE-2013-6075/


External References:

http://strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-(cve-2013-6075).html

Comment 1 Vincent Danen 2013-11-02 16:59:07 UTC
This issue does not affect libreswan or openswan.  The compare_dn() function that is affected does not exist in either libreswan or openswan, and the IKE fragmentation implementation is different, not including this vulnerable code.


Statement:

Not vulnerable. This issue did not affect the versions of openswan as shipped with Red Hat Enterprise Linux 5 and 6.

Comment 2 Vincent Danen 2013-11-02 16:59:49 UTC
Created strongswan tracking bugs for this issue:

Affects: fedora-all [bug 1025974]
Affects: epel-6 [bug 1025975]

Comment 3 Fedora Update System 2014-01-25 02:25:56 UTC
strongswan-5.1.1-4.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2014-01-25 02:26:55 UTC
strongswan-5.1.1-4.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2014-01-25 05:09:20 UTC
strongswan-5.1.1-4.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.