Paul Wouters of Red Hat reports:
The Openswan Project was notified by Iustina Melinte of a vulnerability
regarding dereferencing of non-received IKEv2 payloads. This allows
a malicious non-authenticated remote user to cause a denial of service
in the Openswan IKE daemon that can also cause existing VPN connections
Iustina Melinte used a custom IKE fuzzer to test Openswan. By withholding
or renumbering certain IKEv2 payloads, the pluto IKE daemon crashes while
trying to dereference a NULL pointer on the presumably received payload.
Note: by default, the use of IKEv2 payloads is set to 'permit', "signifying
no IKEv2 should be transmitted, but will be accepted if the other ends
initiates to us with IKEv2" (man ipsec.conf). Configurations that only
allow IKEv1 payloads (where "ikev2=" is set to 'never' or 'no' in the
ipsec.conf file) are not vulnerable.
This vulnerability was found by Iustina Melinte.
Created openswan tracking bugs for this issue:
Affects: fedora-all [bug 1058402]
we don't ship openswan in fedora anymore. The packages have been obsoleted by the libreswan packages. We cannot do any more fedora openswan packages.
Note that openswan-2.6.40 did not properly fix this issue, as they did not use the backported libreswan patch we provided them. So while openswan 2.6.40 will get a new CVE number for this issue, our packages for errata RHSA-2014:0185 are not vulnerable.
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 5
Via RHSA-2014:0185 https://rhn.redhat.com/errata/RHSA-2014-0185.html
A CVE for upstream openswan will be assigned soon, as this CVE was not fully fixed in the upstream release. The Red Hat packages, however, used the correct patch and thus fully fixed the issue.
CVE-2014-2037 is assigned to openswan-2.6.41. And to confirm, our release from RHSA-2014:0185 is not vulnerable
CVE-2014-2037 is assigned to openswan-2.6.40
Created attachment 867908 [details]