PT-2015-7707 · Strongswan+3 · Strongswan+3

Tobias Brunner · Publicado 2015-11-16 · Atualizado 2024-06-15 · CVE-2015-8023

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions strongSwan versions 4.2.12 through 5.x before 5.3.4

Description The issue concerns the server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin. It does not properly validate local state, allowing remote attackers to bypass authentication. This can be achieved by sending an empty Success message in response to an initial Challenge message.

Recommendations For strongSwan versions 4.2.12 through 5.x before 5.3.4, update to version 5.3.4 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-264

Identificadores relacionados

ALT-PU-2015-2000

CVE-2015-8023

DLA-345-1

DSA-3398-1

OPENSUSE-SU-2024:10579-1

SUSE-SU-2015:2183-1

SUSE-SU-2015:2183-2

SUSE-SU-2015:2186-1

SUSE-SU-2015_2183-1

SUSE-SU-2015_2183-2

SUSE-SU-2015_2186-1

USN-2811-1

Produtos afetados

Alt Linux

Suse

Ubuntu

Strongswan

Referências · 47

• https://osv.dev/vulnerability/CVE-2015-8023 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10579-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/strongswan · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8023 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-2944 · Nota
• https://suse.com/security/cve/CVE-2015-3991 · Nota
• http://securityfocus.com/bid/84947 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2015:2183-2 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8023 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2015-8023 · Nota de Segurança
• http://ubuntu.com/usn/USN-2811-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-8023.html · Nota
• https://suse.com/security/cve/CVE-2013-6075 · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2015-December/001715.html · Nota