The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.

From Red Hat Security Advisory 2009:1138 :

Updated openswan packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Openswan is a free implementation of Internet Protocol Security (IPsec) and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide both authentication and encryption services.
These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the IPsec gateway machine, and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network (VPN).

Multiple insufficient input validation flaws were found in the way Openswan's pluto IKE daemon processed some fields of X.509 certificates. A remote attacker could provide a specially crafted X.509 certificate that would crash the pluto daemon. (CVE-2009-2185)

All users of openswan are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.
After installing this update, the ipsec service will be restarted automatically.

The previous fix for a flaw in the ASN.1 parser was incomplete and had to be reworked. (CVE-2009-2661) This could lead to crashes of the pluto IKE daemon.

Several remote vulnerabilities have been discovered in strongswan, an implementation of the IPSEC and IKE protocols. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1957 CVE-2009-1958     The charon daemon can crash when processing certain     crafted IKEv2 packets. (The old stable distribution     (etch) was not affected by these two problems because it     lacks IKEv2 support.)

  - CVE-2009-2185 CVE-2009-2661     The pluto daemon could crash when processing a crafted     X.509 certificate.

Updated openswan packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Openswan is a free implementation of Internet Protocol Security (IPsec) and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide both authentication and encryption services.
These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the IPsec gateway machine, and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network (VPN).

Multiple insufficient input validation flaws were found in the way Openswan's pluto IKE daemon processed some fields of X.509 certificates. A remote attacker could provide a specially crafted X.509 certificate that would crash the pluto daemon. (CVE-2009-2185)

All users of openswan are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.
After installing this update, the ipsec service will be restarted automatically.

ID	Name	Product	Family	Severity
67887	Oracle Linux 5 : openswan (ELSA-2009-1138)	Nessus	Oracle Linux Local Security Checks	medium
49926	SuSE 10 Security Update : strongswan (ZYPP Patch Number 6529)	Nessus	SuSE Local Security Checks	medium
44764	Debian DSA-1899-1 : strongswan - several vulnerabilities	Nessus	Debian Local Security Checks	medium
43765	CentOS 5 : openswan (CESA-2009:1138)	Nessus	CentOS Local Security Checks	medium
42028	openSUSE 10 Security Update : openswan (openswan-6481)	Nessus	SuSE Local Security Checks	medium
41621	SuSE9 Security Update : freeswan (YOU Patch Number 12503)	Nessus	SuSE Local Security Checks	medium
41589	SuSE 10 Security Update : strongswan (ZYPP Patch Number 6480)	Nessus	SuSE Local Security Checks	medium
41576	SuSE 10 Security Update : openswan (ZYPP Patch Number 6478)	Nessus	SuSE Local Security Checks	medium
41457	SuSE 11 Security Update : strongswan (SAT Patch Number 1283)	Nessus	SuSE Local Security Checks	medium
41446	SuSE 11 Security Update : openswan (SAT Patch Number 1296)	Nessus	SuSE Local Security Checks	medium
41044	openSUSE Security Update : strongswan (strongswan-1281)	Nessus	SuSE Local Security Checks	medium
41043	openSUSE Security Update : openswan (openswan-1285)	Nessus	SuSE Local Security Checks	medium
41038	openSUSE Security Update : strongswan (strongswan-1281)	Nessus	SuSE Local Security Checks	medium
41037	openSUSE Security Update : openswan (openswan-1285)	Nessus	SuSE Local Security Checks	medium
39597	RHEL 5 : openswan (RHSA-2009:1138)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2009-2661

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium