The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0402 advisory.

    [2.6.14-1.2]
    - security update (CVE-2009-0790, CVE-2008-4190)     Resolves: CVE-2009-0790, CVE-2008-4190

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Gerd v. Egidy discovered a flaw in the Dead Peer Detection (DPD) in Openswan's pluto IKE daemon. A remote attacker could use a malicious DPD packet to crash the pluto daemon. (CVE-2009-0790)

It was discovered that Openswan's livetest script created temporary files in an insecure manner. A local attacker could use this flaw to overwritearbitrary files owned by the user running the script.
(CVE-2008-4190)

After installing this update, the ipsec service will be restarted automatically.

Updated openswan packages that fix various security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Openswan is a free implementation of Internet Protocol Security (IPsec) and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide both authentication and encryption services.
These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the IPsec gateway machine, and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network (VPN).

Gerd v. Egidy discovered a flaw in the Dead Peer Detection (DPD) in Openswan's pluto IKE daemon. A remote attacker could use a malicious DPD packet to crash the pluto daemon. (CVE-2009-0790)

It was discovered that Openswan's livetest script created temporary files in an insecure manner. A local attacker could use this flaw to overwrite arbitrary files owned by the user running the script.
(CVE-2008-4190)

Note: The livetest script is an incomplete feature and was not automatically executed by any other script distributed with Openswan, or intended to be used at all, as was documented in its man page. In these updated packages, the script only prints an informative message and exits immediately when run.

All users of openswan are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
After installing this update, the ipsec service will be restarted automatically.

By sending a specially crafted Dead Peer Detection (DPD) packet remote attackers could crash the pluto IKE daemon. (CVE-2009-0790)

The remote host is affected by the vulnerability described in GLSA-200909-05 (Openswan: Denial of Service)

    Multiple vulnerabilities have been discovered in Openswan:
    Gerd v. Egidy reported a NULL pointer dereference in the Dead Peer     Detection of the pluto IKE daemon as included in Openswan     (CVE-2009-0790).
    The Orange Labs vulnerability research team     discovered multiple vulnerabilities in the ASN.1 parser     (CVE-2009-2185).
  Impact :

    A remote attacker could exploit these vulnerabilities by sending     specially crafted R_U_THERE or R_U_THERE_ACK packets, or a specially     crafted X.509 certificate containing a malicious Relative Distinguished     Name (RDN), UTCTIME string or GENERALIZEDTIME string to cause a Denial     of Service of the pluto IKE daemon.
  Workaround :

    There is no known workaround at this time.

By sending a specially crafted Dead Peer Detection (DPD) packet remote attackers could crash the pluto IKE daemon (CVE-2009-0790).

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0402 advisory.

    Openswan is a free implementation of Internet Protocol Security (IPsec)     and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide     both authentication and encryption services. These services allow you to     build secure tunnels through untrusted networks. Everything passing through     the untrusted network is encrypted by the IPsec gateway machine, and     decrypted by the gateway at the other end of the tunnel. The resulting     tunnel is a virtual private network (VPN).

    Gerd v. Egidy discovered a flaw in the Dead Peer Detection (DPD) in     Openswan's pluto IKE daemon. A remote attacker could use a malicious DPD     packet to crash the pluto daemon. (CVE-2009-0790)

    It was discovered that Openswan's livetest script created temporary files     in an insecure manner. A local attacker could use this flaw to overwrite     arbitrary files owned by the user running the script. (CVE-2008-4190)

    Note: The livetest script is an incomplete feature and was not     automatically executed by any other script distributed with Openswan, or     intended to be used at all, as was documented in its man page. In these     updated packages, the script only prints an informative message and exits     immediately when run.

    All users of openswan are advised to upgrade to these updated packages,     which contain backported patches to correct these issues. After installing     this update, the ipsec service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities have been discovered in openswan, an IPSec implementation for linux. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-4190     Dmitry E. Oboukhov discovered that the livetest tool is     using temporary files insecurely, which could lead to a     denial of service attack.

  - CVE-2009-0790     Gerd v. Egidy discovered that the Pluto IKE daemon in     openswan is prone to a denial of service attack via a     malicious packet.

Gerd v. Egidy discovered that the Pluto IKE daemon in strongswan, an IPSec implementation for linux, is prone to a denial of service attack via a malicious packet.

ID	Name	Product	Family	Severity
67835	Oracle Linux 5 : openswan (ELSA-2009-0402)	Nessus	Oracle Linux Local Security Checks	high
60558	Scientific Linux Security Update : openswan on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
43738	CentOS 5 : openswan (CESA-2009:0402)	Nessus	CentOS Local Security Checks	medium
41586	SuSE 10 Security Update : strongswan (ZYPP Patch Number 6116)	Nessus	SuSE Local Security Checks	medium
41574	SuSE 10 Security Update : openswan (ZYPP Patch Number 6117)	Nessus	SuSE Local Security Checks	medium
41454	SuSE 11 Security Update : strongswan (SAT Patch Number 677)	Nessus	SuSE Local Security Checks	medium
41444	SuSE 11 Security Update : openswan (SAT Patch Number 678)	Nessus	SuSE Local Security Checks	medium
40913	GLSA-200909-05 : Openswan: Denial of Service	Nessus	Gentoo Local Security Checks	medium
40311	openSUSE Security Update : strongswan (strongswan-676)	Nessus	SuSE Local Security Checks	medium
40287	openSUSE Security Update : openswan (openswan-687)	Nessus	SuSE Local Security Checks	medium
40136	openSUSE Security Update : strongswan (strongswan-676)	Nessus	SuSE Local Security Checks	medium
40086	openSUSE Security Update : openswan (openswan-687)	Nessus	SuSE Local Security Checks	medium
36116	openSUSE 10 Security Update : openswan (openswan-6119)	Nessus	SuSE Local Security Checks	medium
36065	RHEL 5 : openswan (RHSA-2009:0402)	Nessus	Red Hat Local Security Checks	high
36053	Debian DSA-1760-1 : openswan - denial of service	Nessus	Debian Local Security Checks	medium
36052	Debian DSA-1759-1 : strongswan - denial of service	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2009-0790

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium