PT-2009-1086 · Openswan+2 · Openswan+2
Gerd V. Egidy
·
Publicado
2009-03-30
·
Atualizado
2024-06-15
·
CVE-2009-0790
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Openswan versions 2.4 through 2.4.14
Openswan versions 2.6 through 2.6.20
Strongswan versions 2.4 through 2.4.14
Strongswan versions 2.6 through 2.6.20
Strongswan versions 2.8 through 2.8.8
Strongswan versions 4.2 through 4.2.13
Description
The issue allows remote attackers to cause a denial of service via crafted Dead Peer Detection IPsec IKE Notification messages, specifically R U THERE or R U THERE ACK, which can trigger a NULL pointer dereference due to inconsistent ISAKMP state and the lack of a phase2 state association in DPD. This can lead to a daemon crash and restart. Multiple vulnerabilities in the openswan package can be exploited remotely, potentially disrupting the availability of protected information.
Recommendations
For Openswan versions 2.4 through 2.4.14, update to version 2.4.15 or later.
For Openswan versions 2.6 through 2.6.20, update to version 2.6.21 or later.
For Strongswan versions 2.4 through 2.4.14, update to version 2.4.15 or later.
For Strongswan versions 2.6 through 2.6.20, update to version 2.6.21 or later.
For Strongswan versions 2.8 through 2.8.8, update to version 2.8.9 or later.
For Strongswan versions 4.2 through 4.2.13, update to version 4.2.14 or later.
Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Openswan
Red Hat
Strongswan