From ${URL} : A denial of service vulnerability was discovered in strongSwan's IKDE daemon charon. This flaw can be triggered by a crafted ID_DER_ASN1_DN ID payload and is caused by an insufficient length check when comparing such identities. This could cause a memory read outside specified boundaries or a NULL dereference which would result in an IKE daemon crash. As no write operation is performed, code injection is unlikely. As well, with a crafted ID payload, an attacker could impersonate a different user and get access to VPN connection profiles the victim would have access to. However, this would require that the attacker successfully authenticate with appropriate credentials, and as such upstream indicates that it seems quite difficult to construct such an attack, although it may be possible. strongSwan 5.1.1 corrects this flaw. A patch [1] is provided for older releases. All versions since 4.3.3 are affected. [1] http://download.strongswan.org/security/CVE-2013-6075/ External References: http://strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-(cve-2013-6075).html @maintainer(s): since the fixed package is already in the tree, please say explicitly if it is ready for the stabilization or not.
I suggest stabilizing the 5.1.1 version, instead of patching the older version, since it fixes other bugs too, that people will benefit from :-)
(In reply to Bjarke Istrup Pedersen from comment #1) > I suggest stabilizing the 5.1.1 version, instead of patching the older > version, since it fixes other bugs too, that people will benefit from :-) If that is where you would like to go and if you think we can create and stable build within the suggested time-line of 20 days then lets go with it. Setting back to [ebuild] status, please let us know when ready for stabilization.
(In reply to Yury German from comment #2) > (In reply to Bjarke Istrup Pedersen from comment #1) > > I suggest stabilizing the 5.1.1 version, instead of patching the older > > version, since it fixes other bugs too, that people will benefit from :-) > > If that is where you would like to go and if you think we can create and > stable build within the suggested time-line of 20 days then lets go with it. > > Setting back to [ebuild] status, please let us know when ready for > stabilization. He said that is fine. Arches, please test and mark stable: =net-misc/strongswan-5.1.1 Target keywords : "amd64 arm ppc x86"
https://bugzilla.redhat.com/show_bug.cgi?id=1026152: A NULL pointer dereference flaw was discovered in strongSwan's IKE daemon, charon. An attacker could use this flaw to crash charon by sending a specially-crafted IKEv1 fragmentation payload. strongSwan 5.1.1 corrects this flaw. A patch is provided for versions 5.0.2 and newer: http://download.strongswan.org/security/CVE-2013-6076/strongswan-5.0.2-5.1.0_ikev1_fragment.patch External References: http://strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-(cve-2013-6076).html
CVE-2013-6076 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6076): strongSwan 5.0.2 through 5.1.0 allows remote attackers to cause a denial of service (NULL pointer dereference and charon daemon crash) via a crafted IKEv1 fragmentation packet. CVE-2013-6075 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6075): The compare_dn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows (1) remote attackers to cause a denial of service (out-of-bounds read, NULL pointer dereference, and daemon crash) or (2) remote authenticated users to impersonate arbitrary users and bypass access restrictions via a crafted ID_DER_ASN1_DN ID, related to an "insufficient length check" during identity comparison.
amd64 stable
x86 stable
arm stable
ppc stable. Maintainer(s), please cleanup
Old version has been removed from the tree.
GLSA vote: no.
GLSA vote: no Closing as noglsa
