Detections
Analytics
MiracleLinux 4 : openswan-2.6.32-27.2.0.1.AXS4 (AXSA:2014-035:01)
high Nessus Plugin ID 289752
Synopsis
The remote MiracleLinux host is missing a security update.Description
The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2014-035:01 advisory.Openswan is a free implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted net is encrypted by the ipsec gateway machine and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network or VPN.
This package contains the daemons and userland tools for setting up Openswan. It supports the NETKEY/XFRM IPsec kernel stack that exists in the default Linux kernel.
Openswan 2.6.x also supports IKEv2 (RFC4306) Security issues fixed with this release:
CVE-2013-6466 Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads.
Fixed bugs:
Previously, when the signature of a Certificate Revocation List started with a zero, the verification failed. This has been fixed.
Fixed the order of the load_crls() and load_authcerts_from_nss() functions in the plutomain.c file so that the IPsec daemon (pluto) no longer fails during startup and loads the CRLs successfully.
It is now possible to establish an IKE tunnel when the xauth option is enabled and the leftmodecfgclient option is disabled in the /etc/ipsec.conf file. This previously did not work and has been fied.
Previously, Openswan could not establish L2TP connection with devices using NAT-Traversal. This has been fixed and support for passing traffic selectors to an XFRM IPsec stack for transport mode is now complete.
Openswan can now use SHA2 algorithms in FIPS mode.
Enhancements:
Added support for Internet Key Exchage (IKE) fragmentation.
Added support for the Internet Key Exchage version 1 (IKEv1) INITIAL-CONTACT IPsec message, as per RFC2407 Section 4.6.3.3.
Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Update the affected openswan package.See Also
Plugin Details
Severity: High
ID: 289752
File Name: miracle_linux_AXSA-2014-035.nasl
Version: 1.1
Type: local
Published: 1/16/2026
Updated: 1/16/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS Score Source: CVE-2013-6466
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:miracle:linux:openswan, cpe:/o:miracle:linux:4
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/MiracleLinux/release, Host/MiracleLinux/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 3/18/2014
Vulnerability Publication Date: 1/26/2014
Reference Information
CVE: CVE-2013-6466