Detections
Analytics
Scientific Linux Security Update : libreswan on SL7.x x86_64 (20151104)
medium Nessus Plugin ID 86749
Language:
Synopsis
The remote Scientific Linux host is missing one or more security updates.Description
A flaw was discovered in the way Libreswan's IKE daemon processed IKE KE payloads. A remote attacker could send specially crafted IKE payload with a KE payload of g^x=0 that, when processed, would lead to a denial of service (daemon crash). (CVE-2015-3240)Note: Please note that when upgrading from an earlier version of Libreswan, the existing CA certificates in the /etc/ipsec.d/cacerts/ directory and the existing certificate revocation list (CRL) files from the /etc/ipsec.d/crls/ directory are automatically imported into the NSS database. Once completed, these directories are no longer used by Libreswan. To install new CA certificates or new CRLS, the certutil and crlutil commands must be used to import these directly into the Network Security Services (NSS) database.
This update also adds the following enhancements :
- This update adds support for RFC 7383 IKEv2 Fragmentation, RFC 7619 Auth Null and ID Null, INVALID_KE renegotiation, CRL and OCSP support via NSS, AES_CTR and AES_GCM support for IKEv2, CAVS testing for FIPS compliance.
In addition, this update enforces FIPS algorithms restrictions in FIPS mode, and runs Composite Application Validation System (CAVS) testing for FIPS compliance during package build. A new Cryptographic Algorithm Validation Program (CAVP) binary can be used to re-run the CAVS tests at any time. Regardless of FIPS mode, the pluto daemon runs RFC test vectors for various algorithms.
Furthermore, compiling on all architectures now enables the '-Werror' GCC option, which enhances the security by making all warnings into errors.
- This update also fixes several memory leaks and introduces a sub-second packet retransmit option.
- This update improves migration support from Openswan to Libreswan. Specifically, all Openswan options that can take a time value without a suffix are now supported, and several new keywords for use in the /etc/ipsec.conf file have been introduced. See the relevant man pages for details.
- With this update, loopback support via the 'loopback=' option has been deprecated.
Solution
Update the affected libreswan and / or libreswan-debuginfo packages.See Also
Plugin Details
Severity: Medium
ID: 86749
File Name: sl_20151104_libreswan_on_SL7_x.nasl
Version: 2.5
Type: local
Agent: unix
Published: 11/5/2015
Updated: 1/14/2021
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: p-cpe:/a:fermilab:scientific_linux:libreswan, p-cpe:/a:fermilab:scientific_linux:libreswan-debuginfo, x-cpe:/o:fermilab:scientific_linux
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Patch Publication Date: 11/4/2015
Vulnerability Publication Date: 11/9/2015
Reference Information
CVE: CVE-2015-3240