An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:2070 advisory.

  - libreswan: DoS attack via malicious IKEv1 informational exchange message (CVE-2020-1763)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202007-21 (Libreswan: Denial of service)

    As a result of a bug in handling certain bogus encrypted IKEv1, while       building a log message that the packet has been dropped, a NULL pointer       dereference causes Libreswan to crash and restart when it attempts to log       the state name involved.
  Impact :

    An attacker could cause a possible Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote NewStart CGSL host, running version MAIN 6.01, has libreswan packages installed that are affected by a vulnerability:

  - An out-of-bounds buffer read flaw was found in the pluto     daemon of libreswan from versions 3.27 till 3.31 where,     an unauthenticated attacker could use this flaw to crash     libreswan by sending specially-crafted IKEv1     Informational Exchange packets. The daemon respawns     after the crash. (CVE-2020-1763)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-2070 advisory.

    [3.29-7.0.1]
    - Add libreswan-oracle.patch to detect Oracle Linux distro

    [3.29-7]
    - Resolves: rhbz#1814935 CVE-2020-1763 doS attack via malicious IKEv1 informational exchange message     [rhel-8.2.0.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Stephan Zeisberg discovered that the libreswan IPsec implementation could be forced into a crash/restart via a malformed IKEv1 Informational Exchange packet, resulting in denial of service.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2069 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: DoS attack via malicious IKEv1 informational exchange message (CVE-2020-1763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2071 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: DoS attack via malicious IKEv1 informational exchange message (CVE-2020-1763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2070 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: DoS attack via malicious IKEv1 informational exchange message (CVE-2020-1763)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
146024	CentOS 8 : libreswan (CESA-2020:2070)	Nessus	CentOS Local Security Checks	high
138944	GLSA-202007-21 : Libreswan: Denial of service	Nessus	Gentoo Local Security Checks	high
138768	NewStart CGSL MAIN 6.01 : libreswan Vulnerability (NS-SA-2020-0035)	Nessus	NewStart CGSL Local Security Checks	high
136601	Oracle Linux 8 : libreswan (ELSA-2020-2070)	Nessus	Oracle Linux Local Security Checks	high
136590	Debian DSA-4684-1 : libreswan - security update	Nessus	Debian Local Security Checks	high
136500	RHEL 8 : libreswan (RHSA-2020:2069)	Nessus	Red Hat Local Security Checks	high
136499	RHEL 8 : libreswan (RHSA-2020:2071)	Nessus	Red Hat Local Security Checks	high
136497	RHEL 8 : libreswan (RHSA-2020:2070)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-1763

high

Tenable Plugins

high

high

high

high

high

high

high

high