PT-2015-6117 · Libreswan+4 · Libreswan+4

Paul Wouters · Publicado 2015-11-03 · Atualizado 2023-02-13 · CVE-2015-3240

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libreswan versions prior to 3.15 Openswan versions prior to 2.6.45

Description The issue allows remote attackers to cause a denial of service, resulting in an assertion failure and daemon restart. This occurs when a zero DH g^x value is present in a KE payload within an IKE packet. The affected software must be built with NSS for this issue to be exploitable.

Recommendations For libreswan versions prior to 3.15, update to version 3.15 or later. For Openswan versions prior to 2.6.45, update to version 2.6.45 or later.

Correção

DoS

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CESA-2015_1979

CVE-2015-3240

RHSA-2015:1979

RHSA-2015_1979

Produtos afetados

Centos

Nss

Openswan

Red Hat

Libreswan

Referências · 17

• http://rhn.redhat.com/errata/RHSA-2015-1979.html · Aviso do Fabricante
• http://oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html · Nota
• http://securityfocus.com/bid/77536 · Nota
• https://lists.centos.org/pipermail/centos-announce/2015-November/033500.html · Nota
• https://rhn.redhat.com/errata/RHSA-2015-1979.html · Nota
• https://access.redhat.com/errata/RHSA-2015:1979 · Nota
• https://security.gentoo.org/glsa/201603-13 · Aviso do Fabricante
• http://securitytracker.com/id/1033418 · Nota
• https://linux.oracle.com/errata/ELSA-2015-1979.html · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2015-November/058381.html · Nota
• https://libreswan.org/security/CVE-2015-3240/CVE-2015-3240.txt · Aviso do Fabricante
• https://lists.openswan.org/pipermail/users/2015-August/023401.html · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2015-November/083624.html · Nota
• https://lists.centos.org/pipermail/centos-announce/2015-November/070937.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3240 · Nota de Segurança