Vulnerability Details : CVE-2015-4171
strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.
Vulnerability category: Information leak
Products affected by CVE-2015-4171
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:4.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan:5.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:strongswan:strongswan_vpn_client:*:*:*:*:*:android:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-4171
0.49%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 76 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-4171
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.6
|
LOW | AV:N/AC:H/Au:N/C:P/I:N/A:N |
4.9
|
2.9
|
NIST |
CWE ids for CVE-2015-4171
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-4171
-
https://play.google.com/store/apps/details?id=org.strongswan.android
strongSwan VPN Client - Apps on Google PlayPatch
-
http://www.openwall.com/lists/oss-security/2015/05/29/7
oss-security - Re: StrongSwan VPN client for Android leaks username to rouge server
-
https://www.suse.com/security/cve/CVE-2015-4171.html
CVE-2015-4171 | SUSE
-
http://lists.opensuse.org/opensuse-updates/2015-06/msg00040.html
openSUSE-SU-2015:1082-1: moderate: Security update for strongswan
-
http://www.ubuntu.com/usn/USN-2628-1
USN-2628-1: strongSwan vulnerability | Ubuntu security noticesPatch
-
http://www.openwall.com/lists/oss-security/2015/05/29/6
oss-security - StrongSwan VPN client for Android leaks username to rouge server
-
http://www.debian.org/security/2015/dsa-3282
Debian -- Security Information -- DSA-3282-1 strongswanPatch
-
http://www.securityfocus.com/bid/74933
strongSwan VPN Client DNS Spoofing Vulnerability
-
https://www.strongswan.org/blog/2015/06/08/strongswan-vulnerability-%2528cve-2015-4171%2529.html
strongSwan - strongSwan Vulnerability (CVE-2015-4171)Patch;Vendor Advisory
-
https://bugzilla.suse.com/show_bug.cgi?id=933591
Bug 933591 – VUL-0: CVE-2015-4171: strongswan: rogue servers vulnerability
-
http://www.openwall.com/lists/oss-security/2015/06/08/4
oss-security - Re: StrongSwan VPN client for Android leaks username to rouge server
-
http://www.securitytracker.com/id/1032514
strongSwan IKEv2 Authentication Flaw Lets Remote Authenticated Users Obtain Potentially Sensitive Information - SecurityTracker
Jump to