Debian Security Advisory DSA 2922-1 (strongswan - Security Update) Network Vulnerability

Summary

A vulnerability has been found in the ASN.1 parser of strongSwan, an IKE/IPsec suite used to establish IPsec protected links. By sending a crafted ID_DER_ASN1_DN ID payload to a vulnerable pluto or charon daemon, a malicious remote user can provoke a null pointer dereference in the daemon parsing the identity, leading to a crash and a denial of service.

Solution

For the oldstable distribution (squeeze), this problem has been fixed in version 4.4.1-5.6. For the stable distribution (wheezy), this problem has been fixed in version 4.5.2-1.5+deb7u4. For the testing distribution (jessie), this problem has been fixed in version 5.1.2-1. For the unstable distribution (sid), this problem has been fixed in version 5.1.2-1. We recommend that you upgrade your strongswan packages.

Insight

The strongSwan VPN suite is based on the IPsec stack in standard Linux 2.6 kernels. It supports both the IKEv1 and IKEv2 protocols.

Affected

strongswan on Debian Linux

Detection

This check tests the installed software version using the apt package manager.

References