strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.

According to the versions of the strongimcv package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The gmp plugin in strongSwan before 5.7.1 has a Buffer     Overflow via a crafted certificate.(CVE-2018-17540)

  - In verify_emsa_pkcs1_signature() in     gmp_rsa_public_key.c in the gmp plugin in strongSwan     4.x and 5.x before 5.7.0, the RSA implementation based     on GMP does not reject excess data in the     digestAlgorithm.parameters field during PKCS#1 v1.5     signature verification. Consequently, a remote attacker     can forge signatures when small public exponents are     being used, which could lead to impersonation when only     an RSA signature is used for IKEv2 authentication. This     is a variant of CVE-2006-4790 and     CVE-2014-1568.(CVE-2018-16152)

  - In verify_emsa_pkcs1_signature() in     gmp_rsa_public_key.c in the gmp plugin in strongSwan     4.x and 5.x before 5.7.0, the RSA implementation based     on GMP does not reject excess data after the encoded     algorithm OID during PKCS#1 v1.5 signature     verification. Similar to the flaw in the same version     of strongSwan regarding digestAlgorithm.parameters, a     remote attacker can forge signatures when small public     exponents are being used, which could lead to     impersonation when only an RSA signature is used for     IKEv2 authentication.(CVE-2018-16151)

  - strongSwan 5.6.0 and older allows Remote Denial of     Service because of Missing Initialization of a     Variable.(CVE-2018-10811)

  - The gmp plugin in strongSwan before 5.5.3 does not     properly validate RSA public keys before calling     mpz_powm_sec, which allows remote peers to cause a     denial of service (floating point exception and process     crash) via a crafted certificate.(CVE-2017-9022)

  - The gmp plugin in strongSwan before 5.6.0 allows remote     attackers to cause a denial of service (NULL pointer     dereference and daemon crash) via a crafted RSA     signature.(CVE-2017-11185)

  - The server implementation of the EAP-MSCHAPv2 protocol     in the eap-mschapv2 plugin in strongSwan 4.2.12 through     5.x before 5.3.4 does not properly validate local     state, which allows remote attackers to bypass     authentication via an empty Success message in response     to an initial Challenge message.(CVE-2015-8023)

  - strongSwan 4.3.0 through 5.x before 5.3.2 and     strongSwan VPN Client before 1.4.6, when using EAP or     pre-shared keys for authenticating an IKEv2 connection,     does not enforce server authentication restrictions     until the entire authentication process is complete,     which allows remote servers to obtain credentials by     using a valid certificate and then reading the     responses.(CVE-2015-4171)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the remote pfSense install is prior to 2.2.3. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories.

strongswan was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-4171: A problem that could enable rogue servers     to gain user credentials from a client in certain IKEv2     setups. (bsc#933591)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

strongswan was updated to fix two security issues :

An issue that could enable rogue servers to gain user credentials from a client in certain IKEv2 setups. (CVE-2015-4171)

A bug in decoding ID_DER_ASN1_DN ID payloads that could be used for remote denial of service attacks. (CVE-2014-2891)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

strongswan was updated to fix a problem that could enable rogue servers to gain user credentials from a client in certain IKEv2 setups. (CVE-2015-4171)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Strongswan was updated to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-4171: Rogue servers were able to authenticate     themselves with certificate issued by any CA the client     trusts, to gain user credentials from a client in     certain IKEv2 setups (bsc#933591)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

strongswan was updated to fix a rogue servers vulnerability, that may enable rogue servers able to authenticate itself with certificate issued by any CA the client trusts, to gain user credentials from a client in certain IKEv2 setups (bsc#933591,CVE-2015-4171).

More information can be found on https://www.strongswan.org/blog/2015/06/08/strongswan-vulnerability-%2 8cve-2015-4171%29.html

Alexander E. Patrakov discovered an issue in strongSwan, an IKE/IPsec suite used to establish IPsec protected links.

When a client authenticate the server with certificates and the client authenticates using pre-shared key or EAP, the constraints on the server certificate are only enforced by the client after all authentication steps are completed successfully. A rogue server which can authenticate using a valid certificate issued by any CA trusted by the client could trick the user into continuing the authentication, revealing the username and password digest (for EAP) or even the cleartext password (if EAP-GTC is accepted).

  - -- Yves-Alexis Perez

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

strongSwan Project reports :

An information leak vulnerability was fixed that, in certain IKEv2 setups, allowed rogue servers with a valid certificate accepted by the client to trick it into disclosing user credentials (even plain passwords if the client accepts EAP-GTC). This was caused because constraints against the server's authentication were enforced too late. All versions since 4.3.0 are affected.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2628-1 advisory.

    Alexander E. Patrakov discovered that strongSwan incorrectly handled certain IKEv2 setups. A malicious     server could possibly use this issue to obtain user credentials.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Alexander E. Patrakov discovered an issue in strongSwan, an IKE/IPsec suite used to establish IPsec protected links.

When an IKEv2 client authenticates the server with certificates and the client authenticates itself to the server using pre-shared key or EAP, the constraints on the server certificate are only enforced by the client after all authentication steps are completed successfully.
A rogue server which can authenticate using a valid certificate issued by any CA trusted by the client could trick the user into continuing the authentication, revealing the username and password digest (for EAP) or even the cleartext password (if EAP-GTC is accepted).

ID	Name	Product	Family	Severity
146695	EulerOS 2.0 SP2 : strongimcv (EulerOS-SA-2021-1364)	Nessus	Huawei Local Security Checks	high
106495	pfSense < 2.2.3 Multiple Vulnerabilities (SA-15_07) (Logjam)	Nessus	Firewalls	critical
86539	SUSE SLES11 Security Update : strongswan (SUSE-SU-2015:1791-1)	Nessus	SuSE Local Security Checks	low
84725	SUSE SLES10 Security Update : strongswan (SUSE-SU-2015:1228-1)	Nessus	SuSE Local Security Checks	medium
84724	SUSE SLED11 / SLES11 Security Update : strongswan (SUSE-SU-2015:1227-1)	Nessus	SuSE Local Security Checks	low
84562	SUSE SLED12 / SLES12 Security Update : strongswan (SUSE-SU-2015:1196-1)	Nessus	SuSE Local Security Checks	low
84283	openSUSE Security Update : strongswan (openSUSE-2015-432)	Nessus	SuSE Local Security Checks	low
84165	Debian DLA-244-1 : strongswan security update	Nessus	Debian Local Security Checks	low
84068	FreeBSD : strongswan -- Information Leak Vulnerability (10d14955-0e45-11e5-b6a8-002590263bf5)	Nessus	FreeBSD Local Security Checks	low
84045	Ubuntu 14.04 LTS : strongSwan vulnerability (USN-2628-1)	Nessus	Ubuntu Local Security Checks	critical
84026	Debian DSA-3282-1 : strongswan - security update	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2015-4171

critical

Tenable Plugins

high

critical

low

medium

low

low

low

low

low

critical

low