The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2009-1138 advisory.

    [2.6.14-1.3]
    - security update (CVE-2009-2185)     Resolves: CVE-2009-2185

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple insufficient input validation flaws were found in the way Openswan's pluto IKE daemon processed some fields of X.509 certificates. A remote attacker could provide a specially crafted X.509 certificate that would crash the pluto daemon. (CVE-2009-2185)

After installing this update, the ipsec service will be restarted automatically.

Several remote vulnerabilities have been discovered in strongswan, an implementation of the IPSEC and IKE protocols. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1957 CVE-2009-1958     The charon daemon can crash when processing certain     crafted IKEv2 packets. (The old stable distribution     (etch) was not affected by these two problems because it     lacks IKEv2 support.)

  - CVE-2009-2185 CVE-2009-2661     The pluto daemon could crash when processing a crafted     X.509 certificate.

It was discovered that the pluto daemon in openswan, an implementation of IPSEC and IKE, could crash when processing a crafted X.509 certificate.

Updated openswan packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Openswan is a free implementation of Internet Protocol Security (IPsec) and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide both authentication and encryption services.
These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the IPsec gateway machine, and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network (VPN).

Multiple insufficient input validation flaws were found in the way Openswan's pluto IKE daemon processed some fields of X.509 certificates. A remote attacker could provide a specially crafted X.509 certificate that would crash the pluto daemon. (CVE-2009-2185)

All users of openswan are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.
After installing this update, the ipsec service will be restarted automatically.

Two vulnerabilities in the openswan ASN.1 parser (when handling RDNs, UTCTIME and GENERALIZEDTIME strings) could lead to remote crashes of the pluto daemon (CVE-2009-2185).

Two vulnerabilities in the strongswan ASN.1 parser (when handling RDNs, UTCTIME and GENERALIZEDTIME strings) could lead to remote crashes of the pluto daemon. (CVE-2009-2185)

Two vulnerabilities in the openswan ASN.1 parser (when handling RDNs, UTCTIME and GENERALIZEDTIME strings) could lead to remote crashes of the pluto daemon. (CVE-2009-2185)

Two vulnerabilities in the freeswan ASN.1 parser (when handling RDNs, UTCTIME and GENERALIZEDTIME strings) could lead to remote crashes of the pluto daemon (CVE-2009-2185). This has been fixed.

The remote host is affected by the vulnerability described in GLSA-200909-05 (Openswan: Denial of Service)

    Multiple vulnerabilities have been discovered in Openswan:
    Gerd v. Egidy reported a NULL pointer dereference in the Dead Peer     Detection of the pluto IKE daemon as included in Openswan     (CVE-2009-0790).
    The Orange Labs vulnerability research team     discovered multiple vulnerabilities in the ASN.1 parser     (CVE-2009-2185).
  Impact :

    A remote attacker could exploit these vulnerabilities by sending     specially crafted R_U_THERE or R_U_THERE_ACK packets, or a specially     crafted X.509 certificate containing a malicious Relative Distinguished     Name (RDN), UTCTIME string or GENERALIZEDTIME string to cause a Denial     of Service of the pluto IKE daemon.
  Workaround :

    There is no known workaround at this time.

Two vulnerabilities in the strongswan ASN.1 parser (when handling RDNs, UTCTIME and GENERALIZEDTIME strings) could lead to remote crashes of the pluto daemon (CVE-2009-2185).

Fixes Openswan PSK issue with NSS. Fixes CVE-2009-2185

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Jul 6 2009 Avesh Agarwal <avagarwa at redhat.com> -     2.6.21-2

    - Openswan ASN.1 parser vulnerability (CVE-2009-2185)

    - Mon Mar 30 2009 Avesh Agarwal <avagarwa at redhat.com>
      - 2.6.21-1

    - new upstream release

    - Fix for CVE-2009-0790 DPD crasher

    - Fix remaining SADB_EXT_MAX -> K_SADB_EXT_MAX entries

    - Fix ipsec setup --status not showing amount of tunnels       with netkey

    - Wed Dec 17 2008 Avesh Agarwal <avagarwa at redhat.com>
      - 2.6.19-1

    - new upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
67887	Oracle Linux 5 : openswan (ELSA-2009-1138)	Nessus	Oracle Linux Local Security Checks	high
60611	Scientific Linux Security Update : openswan on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
44764	Debian DSA-1899-1 : strongswan - several vulnerabilities	Nessus	Debian Local Security Checks	medium
44763	Debian DSA-1898-1 : openswan - denial of service	Nessus	Debian Local Security Checks	medium
43765	CentOS 5 : openswan (CESA-2009:1138)	Nessus	CentOS Local Security Checks	medium
42027	openSUSE 10 Security Update : openswan (openswan-6329)	Nessus	SuSE Local Security Checks	medium
41588	SuSE 10 Security Update : strongswan (ZYPP Patch Number 6327)	Nessus	SuSE Local Security Checks	medium
41575	SuSE 10 Security Update : openswan (ZYPP Patch Number 6328)	Nessus	SuSE Local Security Checks	medium
41456	SuSE 11 Security Update : strongswan (SAT Patch Number 1042)	Nessus	SuSE Local Security Checks	medium
41445	SuSE 11 Security Update : openswan (SAT Patch Number 1048)	Nessus	SuSE Local Security Checks	medium
41309	SuSE9 Security Update : freeswan (YOU Patch Number 12445)	Nessus	SuSE Local Security Checks	medium
40913	GLSA-200909-05 : Openswan: Denial of Service	Nessus	Gentoo Local Security Checks	medium
40313	openSUSE Security Update : strongswan (strongswan-1050)	Nessus	SuSE Local Security Checks	medium
40288	openSUSE Security Update : openswan (openswan-1052)	Nessus	SuSE Local Security Checks	medium
40138	openSUSE Security Update : strongswan (strongswan-1050)	Nessus	SuSE Local Security Checks	medium
40087	openSUSE Security Update : openswan (openswan-1052)	Nessus	SuSE Local Security Checks	medium
39773	Fedora 11 : openswan-2.6.21-5.fc11 (2009-7478)	Nessus	Fedora Local Security Checks	medium
39772	Fedora 10 : openswan-2.6.21-2.fc10 (2009-7423)	Nessus	Fedora Local Security Checks	medium
39597	RHEL 5 : openswan (RHSA-2009:1138)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2009-2185

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium