Executive Summary

Summary
Title strongSwan: Multiple Vulnerabilities
Informations
Name GLSA-201412-26 First vendor Publication 2014-12-13
Vendor Gentoo Last vendor Modification 2014-12-13
Severity (Vendor) Normal Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:N)
Cvss Base Score 6.4 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Two vulnerabilities have been found in strongSwan, possibly resulting in Denial of Service or a bypass in authentication restrictions.

Background

strongSwan is an IPSec implementation for Linux.

Description

A NULL pointer dereference and an error in the IKEv2 implementation have been found in strongSwan.

Impact

A remote attacker could create a Denial of Service condition or bypass security restrictions.

Workaround

There is no known workaround at this time.

Resolution

All strongSwan users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/strongswan-5.1.3"

References

[ 1 ] CVE-2014-2338 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2338
[ 2 ] CVE-2014-2891 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2891

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201412-26.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201412-26.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-287 Improper Authentication

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:24282
 
Oval ID: oval:org.mitre.oval:def:24282
Title: DSA-2903-1 strongswan - security update
Description: An authentication bypass vulnerability was found in charon, the daemon handling IKEv2 in strongSwan, an IKE/IPsec suite. The state machine handling the security association (IKE_SA) handled some state transitions incorrectly.
Family: unix Class: patch
Reference(s): DSA-2903-1
CVE-2014-2338
 Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
 Product(s): strongswan
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24774
 
Oval ID: oval:org.mitre.oval:def:24774
Title: DSA-2922-1 strongswan - security update
Description: A vulnerability has been found in the ASN.1 parser of strongSwan, anIKE/IPsec suite used to establish IPsec protected links.
Family: unix Class: patch
Reference(s): DSA-2922-1
CVE-2014-2891
 Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
 Product(s): strongswan
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25268
 
Oval ID: oval:org.mitre.oval:def:25268
Title: SUSE-SU-2014:0529-1 -- Security update for strongswan
Description: The following security issue is fixed by this update: * bnc#870572: strongswan has been updated to fix an authentication problem where attackers could have bypassed the IKEv2 authentication. (CVE-2014-2338) Security Issue reference: * CVE-2014-2338 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2338 >
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0529-1
CVE-2014-2338
 Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Server 10
SUSE Linux Enterprise Desktop 11
 Product(s): strongswan
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26053
 
Oval ID: oval:org.mitre.oval:def:26053
Title: SUSE-SU-2014:0793-1 -- Security update for strongswan
Description: This update fixes a NULL ptr dereference (DoS) via ID_DER_ASN1_DN ID payloads.
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0793-1
CVE-2014-2891
 Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 11
 Product(s): strongswan
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 122

Nessus® Vulnerability Scanner

Date Description
2015-07-14 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-1228-1.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201412-26.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-384.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_strongswan-140514.nasl - Type : ACT_GATHER_INFO
2014-05-06 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2922.nasl - Type : ACT_GATHER_INFO
2014-05-05 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_6fb521b0d38811e3a790000c2980a9f3.nasl - Type : ACT_GATHER_INFO
2014-04-25 Name : The remote Fedora host is missing a security update.
File : fedora_2014-5231.nasl - Type : ACT_GATHER_INFO
2014-04-25 Name : The remote Fedora host is missing a security update.
File : fedora_2014-5238.nasl - Type : ACT_GATHER_INFO
2014-04-16 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_strongswan-140403.nasl - Type : ACT_GATHER_INFO
2014-04-15 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2903.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-12-16 13:25:47
  • Multiple Updates
2014-12-13 21:22:18
  • First insertion