PT-2015-7707 · Strongswan+3 · Strongswan+3

Tobias Brunner · Published 2015-11-16 · Updated 2024-06-15 · CVE-2015-8023

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions strongSwan versions 4.2.12 through 5.x before 5.3.4

Description The issue concerns the server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin. It does not properly validate local state, allowing remote attackers to bypass authentication. This can be achieved by sending an empty Success message in response to an initial Challenge message.

Recommendations For strongSwan versions 4.2.12 through 5.x before 5.3.4, update to version 5.3.4 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-264

Related Identifiers

ALT-PU-2015-2000

CVE-2015-8023

DLA-345-1

DSA-3398-1

OPENSUSE-SU-2024:10579-1

SUSE-SU-2015:2183-1

SUSE-SU-2015:2183-2

SUSE-SU-2015:2186-1

SUSE-SU-2015_2183-1

SUSE-SU-2015_2183-2

SUSE-SU-2015_2186-1

USN-2811-1

Affected Products

Alt Linux

Suse

Ubuntu

Strongswan

References · 47

• https://osv.dev/vulnerability/CVE-2015-8023 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10579-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/strongswan · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8023 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:2183-2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8023 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-8023 · Security Note
• http://ubuntu.com/usn/USN-2811-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2015-2000 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3398-1 · Vendor Advisory
• http://debian.org/security/2015/dsa-3398 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8023 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2811-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:2183-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8023 · Security Note