Vulnerability Details : CVE-2009-2661
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
Vulnerability category: Denial of service
Products affected by CVE-2009-2661
- cpe:2.3:a:strongswan:strongswan:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.2.12:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:2.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:2.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:2.8.8:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:2.8.6:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:2.8.7:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.2.13:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:2.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:2.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:2.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:2.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.2.15:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:2.8.10:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.2.14:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.2.16:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2009-2661
2.51%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 91 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-2661
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2009-2661
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-2661
-
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2009:018 - openSUSE Security Announce - openSUSE Mailing Lists
-
http://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.x.x_asn1_length.patch
Patch
-
http://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.3.x_asn1_length.patch
-
http://up2date.astaro.com/2009/08/up2date_7505_released.html
-
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2009:016 - openSUSE Security Announce - openSUSE Mailing Lists
-
http://www.vupen.com/english/advisories/2009/2247
Site en construction
-
https://lists.strongswan.org/pipermail/announce/2009-July/000056.html
[Announce] ANNOUNCE: strongswan-2.8.11 and strongswan-4.2.17 releasedPatch
-
http://www.openwall.com/lists/oss-security/2009/07/27/1
oss-security - CVE id request: strongswan
-
http://www.debian.org/security/2009/dsa-1899
[SECURITY] [DSA 1899-1] New strongswan packages fix denial of service
Jump to