PT-2009-5057 · Strongswan · Strongswan

Ludwig Nussel · Published 2009-08-04 · Updated 2009-11-24 · CVE-2009-2661

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions strongSwan versions 2.8 through 2.8.10 strongSwan versions 4.2 through 4.2.16 strongSwan versions 4.3 through 4.3.2

Description The issue arises from improper handling of X.509 certificates with crafted Relative Distinguished Names (RDNs) by the asn1 length function. This allows remote attackers to cause a denial of service, specifically a crash of the pluto IKE daemon, via malformed ASN.1 data.

Recommendations For strongSwan versions 2.8 through 2.8.10, update to version 2.8.11 or later. For strongSwan versions 4.2 through 4.2.16, update to version 4.2.17 or later. For strongSwan versions 4.3 through 4.3.2, update to version 4.3.3 or later.

Fix

DoS

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-2661

DSA-1899-1

Affected Products

Strongswan

References · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2009-2661 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2661 · Security Note
• http://debian.org/security/2009/dsa-1899 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-2661 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-2661 · Vendor Advisory
• https://lists.strongswan.org/pipermail/announce/2009-July/000056.html · Patch
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html · Vendor Advisory
• http://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.x.x_asn1_length.patch · Patch
• http://vupen.com/english/advisories/2009/2247 · Note
• http://openwall.com/lists/oss-security/2009/07/27/1 · Note
• http://up2date.astaro.com/2009/08/up2date_7505_released.html · Note
• http://secunia.com/advisories/36922 · Note
• http://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.3.x_asn1_length.patch · Note