PT-2014-1910 · Openswan+2 · Openswan+2

Iustina Melinte · Published 2014-01-26 · Updated 2019-07-29 · CVE-2013-6466

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Openswan versions prior to 2.6.39

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and IKE daemon restart, via IKEv2 packets that lack expected payloads. This can lead to disruption of protected information availability. The exploitation of this issue can be performed remotely.

Recommendations For versions prior to 2.6.39, update to a version later than 2.6.39 to resolve the issue. As a temporary workaround, consider restricting access to IKEv2 packets to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09776

CESA-2014_0185

CVE-2013-6466

DSA-2893-1

MGASA-2014-0097

RHSA-2014:0185

RHSA-2014_0185

Affected Products

Centos

Openswan

Red Hat

References · 21

• https://advisories.mageia.org/MGASA-2014-0097.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-6466 · Security Note
• https://libreswan.org/security/CVE-2013-6467/CVE-2013-6467.txt · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0185.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6466 · Security Note
• http://debian.org/security/2014/dsa-2893 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0097 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-0185.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09776 · Security Note
• https://lists.centos.org/pipermail/centos-announce/2014-February/057080.html · Note
• https://rhn.redhat.com/errata/RHSA-2014-0185.html · Note
• https://lists.centos.org/pipermail/centos-announce/2014-February/069636.html · Note
• https://access.redhat.com/security/cve/CVE-2013-6466 · Note
• https://bugs.mageia.org/show_bug.cgi?id=12823 · Note
• https://lists.centos.org/pipermail/centos-announce/2014-February/032199.html · Note