The is_asn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1_length function, which allows remote attackers to cause a denial of service (segmentation fault) via a (1) XAuth username, (2) EAP identity, or (3) PEM encoded file that starts with a 0x04, 0x30, or 0x31 character followed by an ASN.1 length value that triggers an integer overflow.

This update of strongswan fixed a denial-of-service vulnerability, that could be triggered by special XAuth usernames and EAP identities.

strongSwan Project reports :

A DoS vulnerability triggered by crafted IKEv1 fragmentation payloads was discovered in strongSwan's IKE daemon charon. All versions since 5.0.2 are affected.

A DoS vulnerability and potential authorization bypass triggered by a crafted ID_DER_ASN1_DN ID payload was discovered in strongSwan. All versions since 4.3.3 are affected.

A DoS vulnerability in strongSwan was discovered, which is triggered by XAuth usernames and EAP identities in versions 5.0.3 and 5.0.4.

This strongswan update fixes security issues and bugs :

  - Specially crafted XAuth usernames and EAP identities     could cause a crash in strongswan. (CVE-2013-5018)

  - A crafted ID packet can be used by remote attackers to     crash the server or potentially gain authentication     privileges under certain circumstances. (CVE-2013-6075)

Additionally, a bug in route recursion limits was fixed :

  - Charon segfaults when left=%any / recursion limit.
    (bnc#840826)

The remote host is affected by the vulnerability described in GLSA-201309-02 (strongSwan: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in strongSwan. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could use ECDSA to authenticate as another user with       an invalid signature. Additionally, a remote attacker could send a       specially crafted request, possibly resulting in a Denial of Service.
  Workaround :

    There is no known workaround at this time.

rhbz#981429: New upstream release Fixes CVE-2013-5018: rhbz#991216, rhbz#991215 Fixes rhbz#991859 failed to build in rawhide Updated local patches and removed which are not needed Fixed errors around charon-nm Added plugins libstrongswan-pkcs12.so, libstrongswan-rc2.so, libstrongswan-sshkey.so Added utility imv_policy_manager

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75117	openSUSE Security Update : strongswan (openSUSE-SU-2013:1333-1)	Nessus	SuSE Local Security Checks	medium
75115	openSUSE Security Update : strongswan (openSUSE-SU-2013:1332-1)	Nessus	SuSE Local Security Checks	medium
72156	FreeBSD : strongswan -- multiple DoS vulnerabilities (efa663eb-8754-11e3-9a47-00163e1ed244)	Nessus	FreeBSD Local Security Checks	medium
71392	SuSE 11.2 / 11.3 Security Update : strongswan (SAT Patch Numbers 8488 / 8489)	Nessus	SuSE Local Security Checks	medium
69539	GLSA-201309-02 : strongSwan: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
69405	Fedora 18 : strongswan-5.1.0-2.fc18 (2013-14510)	Nessus	Fedora Local Security Checks	medium
69404	Fedora 19 : strongswan-5.1.0-1.fc19 (2013-14481)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-5018

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium