-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
CVE-2015-3204 malicious payload causing IKE daemon restart URL: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2015-3204 This alert (and any possible updates) is available at the following URLs: https://libreswan.org/security/CVE-2015-3204/ The Libreswan Project was notified by Javantea <jv...@altsci.com> of two vulnerabilities found by fuzzing IKEv1 payloads. The malicious IKE packet causes an unexpected state in the IKE daemon resulting in passert() calls terminating and restarting the IKE daemon. No remote code execution is possible. Vulnerable versions: libreswan 3.9 up to version 3.12 Not vulnerable : libreswan 3.13 and newer If you cannot upgrade to 3.13, please see the above link for a patch for this issue. Vulnerability information - -------------------------- Javantea used a custom IKE fuzzer to test libreswan and found two issues resulting in the libreswan IKE daemon to hit a passert() and restart. By setting unassigned bits of the IPSEC DOI value, an error message string would be printed with string names as bit numbers. Printing 32 of these would cause the internal buffer "bitnamesbuf" to be too small. This buffer is truncated properly in the non-vulnerable versions. A generic jam_str() function was added to these protections, but it would passert() if not given at least a buffer length of 1 (to add a NULL to terminate the string). However, the filled in string would have no more space for the additional 1 character to be added. The passert() would cause the IKE daemon to restart. By setting the next payload value to ISAKMP_NEXT_SAK (used by old Cisco VPN servers to signal NAT-Traversal payloads), the libreswan daemon would attempt to interpret this payload as a NAT-D payload. However, it did not properly do so, causing a passert() which would restart the IKE daemon. Exploitation - ------------- This denial of service can be launched by anyone using a single IKE packet. No authentication credentials are required. No remote code execution is possible through this vulnerability. Libreswan automatically restarts when it crashes. Workaround - ----------- There is no workaround. Either upgrade or use the supplied patch in the above listed resource URL. Credits - -------- This vulnerability was found by Javantea <jv...@altsci.com>. About libreswan (https://libreswan.org/) - ----------------------------------------- Libreswan is a free implementation of the Internet Protocol Security (IPsec) suite and Internet Key Exchange (IKE) protocols. It is a descendant (fork) of openswan 2.6.38. IPsec uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the IPsec gateway machine, and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network (VPN). -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBCgAGBQJVbF24AAoJEISzragz8T5u/OoH/1gUvdHVLzjdYSHxRdtHd+2S /DynEJnW6i5bIQv4TUC/54ELKNVXMkz/HdmSoSPy+lK4M6G+g3uq0HefQ8A0R0C9 6eHCc1/ARAQ9DezPgtAWLnJ5G6LhPCglTcjgBDElEXk/Uy3et7QfA4VANfnHRRPv Kx88C2Dc6IbTzjesUnIWjkbBlBNtxNbRHu7dj4gDaCavbdSE79qbQ8RSTeFxe/P9 Cqip1shfN1S7c+Yl+LRqGz5hjSOy7i29X2bxKG2DnAVxfxYMgBFg7yPiKFf2tQyP f+iXb5XX+h6Lt+nlXcuk5nVW0udGdj40tuJfHLty+KpSIropHBOwu4eLhgPtAHU= =xnTP -----END PGP SIGNATURE----- _______________________________________________ Swan-announce mailing list swan-annou...@lists.libreswan.org https://lists.libreswan.org/mailman/listinfo/swan-announce _______________________________________________ Swan mailing list Swan@lists.libreswan.org https://lists.libreswan.org/mailman/listinfo/swan
