Debian DSA-4309-1 : strongswan - security update

Medium Nessus Plugin ID 117890

Synopsis

The remote Debian host is missing a security-related update.

Description

Google's OSS-Fuzz revealed an exploitable bug in the gmp plugin caused by the patch that fixes CVE-2018-16151 and CVE-2018-16152 (DSA-4305-1).

An attacker could trigger it using crafted certificates with RSA keys with very small moduli. Verifying signatures with such keys would cause an integer underflow and subsequent heap buffer overflow resulting in a crash of the daemon. While arbitrary code execution is not completely ruled out because of the heap buffer overflow, due to the form of the data written to the buffer it seems difficult to actually exploit it in such a way.

Solution

Upgrade the strongswan packages.

For the stable distribution (stretch), this problem has been fixed in version 5.5.1-4+deb9u4.

See Also

https://security-tracker.debian.org/tracker/CVE-2018-16151

https://security-tracker.debian.org/tracker/CVE-2018-16152

https://security-tracker.debian.org/tracker/source-package/strongswan

https://packages.debian.org/source/stretch/strongswan

https://www.debian.org/security/2018/dsa-4309

Plugin Details

Severity: Medium

ID: 117890

File Name: debian_DSA-4309.nasl

Version: 1.5

Type: local

Agent: unix

Published: 2018/10/03

Modified: 2018/11/29

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS v3.0

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:strongswan, cpe:/o:debian:debian_linux:9.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 2018/10/01

Reference Information

CVE: CVE-2018-17540

DSA: 4309