PT-2015-6117 · Libreswan+4 · Libreswan+4

Paul Wouters · Published 2015-11-03 · Updated 2023-02-13 · CVE-2015-3240

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libreswan versions prior to 3.15 Openswan versions prior to 2.6.45

Description The issue allows remote attackers to cause a denial of service, resulting in an assertion failure and daemon restart. This occurs when a zero DH g^x value is present in a KE payload within an IKE packet. The affected software must be built with NSS for this issue to be exploitable.

Recommendations For libreswan versions prior to 3.15, update to version 3.15 or later. For Openswan versions prior to 2.6.45, update to version 2.6.45 or later.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CESA-2015_1979

CVE-2015-3240

RHSA-2015:1979

RHSA-2015_1979

Affected Products

Centos

Nss

Openswan

Red Hat

Libreswan

References · 17

• http://rhn.redhat.com/errata/RHSA-2015-1979.html · Vendor Advisory
• https://security.gentoo.org/glsa/201603-13 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-1979.html · Vendor Advisory
• https://libreswan.org/security/CVE-2015-3240/CVE-2015-3240.txt · Vendor Advisory
• https://lists.openswan.org/pipermail/users/2015-August/023401.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3240 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-3240 · Security Note
• http://oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html · Note
• http://securityfocus.com/bid/77536 · Note
• https://lists.centos.org/pipermail/centos-announce/2015-November/033500.html · Note
• https://rhn.redhat.com/errata/RHSA-2015-1979.html · Note
• https://access.redhat.com/errata/RHSA-2015:1979 · Note
• http://securitytracker.com/id/1033418 · Note
• https://lists.centos.org/pipermail/centos-announce/2015-November/058381.html · Note
• https://lists.centos.org/pipermail/centos-announce/2015-November/083624.html · Note