The compare_dn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows (1) remote attackers to cause a denial of service (out-of-bounds read, NULL pointer dereference, and daemon crash) or (2) remote authenticated users to impersonate arbitrary users and bypass access restrictions via a crafted ID_DER_ASN1_DN ID, related to an "insufficient length check" during identity comparison.

- Applied upstream fix for a denial-of-service and     authorization bypass vulnerability via crafted ID     payload in strongswan 4.3.3 up to 5.1.0 (CVE-2013-6075,     bnc#847506).
    [0005-strongswan-4.3.3_5.1.0-bnc-847506-CVE-2013-6075.pa     tch]

  - Added missed references to patch file 0003.

strongSwan Project reports :

A DoS vulnerability triggered by crafted IKEv1 fragmentation payloads was discovered in strongSwan's IKE daemon charon. All versions since 5.0.2 are affected.

A DoS vulnerability and potential authorization bypass triggered by a crafted ID_DER_ASN1_DN ID payload was discovered in strongSwan. All versions since 4.3.3 are affected.

A DoS vulnerability in strongSwan was discovered, which is triggered by XAuth usernames and EAP identities in versions 5.0.3 and 5.0.4.

This is a major update that includes a version bump, build configuration changes and security updates.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This strongswan update fixes security issues and bugs :

  - Specially crafted XAuth usernames and EAP identities     could cause a crash in strongswan. (CVE-2013-5018)

  - A crafted ID packet can be used by remote attackers to     crash the server or potentially gain authentication     privileges under certain circumstances. (CVE-2013-6075)

Additionally, a bug in route recursion limits was fixed :

  - Charon segfaults when left=%any / recursion limit.
    (bnc#840826)

A vulnerability has been found in the ASN.1 parser of strongSwan, an IKE daemon used to establish IPsec protected links.

By sending a crafted ID_DER_ASN1_DN ID payload to a vulnerable pluto or charon daemon, a malicious remote user can provoke a denial of service (daemon crash) or an authorization bypass (impersonating a different user, potentially acquiring VPN permissions she doesn't have).

ID	Name	Product	Family	Severity
75193	openSUSE Security Update : strongswan (openSUSE-SU-2013:1646-1)	Nessus	SuSE Local Security Checks	medium
72156	FreeBSD : strongswan -- multiple DoS vulnerabilities (efa663eb-8754-11e3-9a47-00163e1ed244)	Nessus	FreeBSD Local Security Checks	medium
72121	Fedora 19 : strongswan-5.1.1-4.fc19 (2014-0567)	Nessus	Fedora Local Security Checks	medium
72120	Fedora 20 : strongswan-5.1.1-4.fc20 (2014-0516)	Nessus	Fedora Local Security Checks	medium
71392	SuSE 11.2 / 11.3 Security Update : strongswan (SAT Patch Numbers 8488 / 8489)	Nessus	SuSE Local Security Checks	medium
70733	Debian DSA-2789-1 : strongswan - Denial of service and authorization bypass	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-6075

high

Tenable Plugins

medium

medium

medium

medium

medium

medium