The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers to cause a denial of service (infinite loop) via a crafted certificate.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - strongswan: Incorrect Handling of CHOICE types in ASN.1 parser and x509 plugin (CVE-2017-9023)

  - In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer     underflow, which may lead to resource exhaustion and denial of service while reading from the socket.
    (CVE-2018-5388)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the version of the strongimcv package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The ASN.1 parser in strongSwan before 5.5.3 improperly     handles CHOICE types when the x509 plugin is enabled,     which allows remote attackers to cause a denial of     service (infinite loop) via a crafted     certificate.(CVE-2017-9023)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the strongimcv package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In stroke_socket.c in strongSwan before 5.6.3, a     missing packet length check could allow a buffer     underflow, which may lead to resource exhaustion and     denial of service while reading from the     socket.(CVE-2018-5388)

  - The ASN.1 parser in strongSwan before 5.5.3 improperly     handles CHOICE types when the x509 plugin is enabled,     which allows remote attackers to cause a denial of     service (infinite loop) via a crafted     certificate.(CVE-2017-9023)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the strongimcv package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The ASN.1 parser in strongSwan before 5.5.3 improperly     handles CHOICE types when the x509 plugin is enabled,     which allows remote attackers to cause a denial of     service (infinite loop) via a crafted     certificate.(CVE-2017-9023)

  - In stroke_socket.c in strongSwan before 5.6.3, a     missing packet length check could allow a buffer     underflow, which may lead to resource exhaustion and     denial of service while reading from the     socket.(CVE-2018-5388)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the strongswan package has been released.

strongSwan security team reports :

- RSA public keys passed to the gmp plugin aren't validated sufficiently before attempting signature verification, so that invalid input might lead to a floating point exception. [CVE-2017-9022]

- ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when parsing X.509 certificates with extensions that use such types.
This could lead to infinite looping of the thread parsing a specifically crafted certificate.

strongSwan security team reports :

ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when parsing X.509 certificates with extensions that use such types. This could lead to infinite looping of the thread parsing a specifically crafted certificate.

This update for strongswan fixes the following issues :

  - CVE-2017-9022: Insufficient Input Validation in gmp     Plugin leads to Denial of service (bsc#1039514)

  - CVE-2017-9023: Incorrect x509 ASN.1 parser error     handling could lead to Denial of service (bsc#1039515)

  - IKEv1 protocol is vulnerable to DoS amplification attack     (bsc#985012)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for strongswan fixes the following issues :

  - CVE-2017-9022: Insufficient Input Validation in gmp     Plugin leads to Denial of service (bsc#1039514)

  - CVE-2017-9023: Incorrect x509 ASN.1 parser error     handling could lead to Denial of service (bsc#1039515)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two denial of service vulnerabilities were identified in strongSwan, an IKE/IPsec suite, using Google's OSS-Fuzz fuzzing project.

CVE-2017-9022

RSA public keys passed to the gmp plugin aren't validated sufficiently before attempting signature verification, so that invalid input might lead to a floating point exception and crash of the process. A certificate with an appropriately prepared public key sent by a peer could be used for a denial of service attack.

CVE-2017-9023

ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when parsing X.509 certificates with extensions that use such types. This could lead to infinite looping of the thread parsing a specifically crafted certificate.

For Debian 7 'Wheezy', these problems have been fixed in version 4.5.2-1.5+deb7u9.

We recommend that you upgrade your strongswan packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3301-1 advisory.

    It was discovered that the strongSwan gmp plugin incorrectly validated RSA public keys. A remote attacker     could use this issue to cause strongSwan to crash, resulting in a denial of service. (CVE-2017-9022)

    It was discovered that strongSwan incorrectly parsed ASN.1 CHOICE types. A remote attacker could use this     issue to cause strongSwan to hang, resulting in a denial of service. (CVE-2017-9023)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two denial of service vulnerabilities were identified in strongSwan, an IKE/IPsec suite, using Google's OSS-Fuzz fuzzing project.

  - CVE-2017-9022     RSA public keys passed to the gmp plugin aren't     validated sufficiently before attempting signature     verification, so that invalid input might lead to a     floating point exception and crash of the process. A     certificate with an appropriately prepared public key     sent by a peer could be used for a denial-of-service     attack.

  - CVE-2017-9023     ASN.1 CHOICE types are not correctly handled by the     ASN.1 parser when parsing X.509 certificates with     extensions that use such types. This could lead to     infinite looping of the thread parsing a specifically     crafted certificate.

A fix for a build failure was additionally included in the 5.2.1-6+deb8u4 revision of the strongSwan package.

ID	Name	Product	Family	Severity
199917	RHEL 7 : strongimcv (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196134	RHEL 7 : strongswan (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
132369	EulerOS 2.0 SP5 : strongimcv (EulerOS-SA-2019-2702)	Nessus	Huawei Local Security Checks	high
132203	EulerOS 2.0 SP3 : strongimcv (EulerOS-SA-2019-2668)	Nessus	Huawei Local Security Checks	high
131601	EulerOS 2.0 SP2 : strongimcv (EulerOS-SA-2019-2447)	Nessus	Huawei Local Security Checks	high
121830	Photon OS 1.0: Strongswan PHSA-2018-1.0-0126	Nessus	PhotonOS Local Security Checks	high
101829	FreeBSD : strongswan -- multiple vulnerabilities (e6ccaf8a-6c63-11e7-9b01-2047478f2f70)	Nessus	FreeBSD Local Security Checks	high
101827	FreeBSD : strongswan -- Denial-of-service vulnerability in the x509 plugin (c7e8e955-6c61-11e7-9b01-2047478f2f70)	Nessus	FreeBSD Local Security Checks	medium
100589	SUSE SLED12 / SLES12 Security Update : strongswan (SUSE-SU-2017:1473-1)	Nessus	SuSE Local Security Checks	high
100588	SUSE SLES11 Security Update : strongswan (SUSE-SU-2017:1471-1)	Nessus	SuSE Local Security Checks	high
100577	Debian DLA-973-1 : strongswan security update	Nessus	Debian Local Security Checks	high
100546	Ubuntu 14.04 LTS / 16.04 LTS : strongSwan vulnerabilities (USN-3301-1)	Nessus	Ubuntu Local Security Checks	high
100520	Debian DSA-3866-1 : strongswan - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-9023

high

Tenable Plugins

high

high

high

high

high

high

high

medium

high

high

high

high

high