CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-38712 – libreswan: Invalid IKEv1 repeat IKE SA delete causes crash and restart
https://notcve.org/view.php?id=CVE-2023-38712
An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart. Se ha descubierto un problema en Libreswan 3.x y 4.x antes de 4.12. Cuando un paquete IKEv1 ISAKMP SA Informational Exchange contiene una carga útil Delete/Notify seguida de más Notifies que actúan sobre el ISAKMP SA, como un mensaje Delete/Notify duplicado, una desviación de puntero NULL en el estado eliminado hace que el demonio pluto se bloquee y se reinicie. A NULL pointer dereference vulnerability was found in the Libreswan package. • https://github.com/libreswan/libreswan/tags https://libreswan.org/security/CVE-2023-38712 https://access.redhat.com/security/cve/CVE-2023-38712 https://bugzilla.redhat.com/show_bug.cgi?id=2225369 • CWE-476: NULL Pointer Dereference •
CVSS: 3.5EPSS: 0%CPEs: 6EXPL: 0CVE-2019-10155 – libreswan: vulnerability in the processing of IKEv1 informational packets due to missing integrity check
https://notcve.org/view.php?id=CVE-2019-10155
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29. Se ha encontrado una vulnerabilidad en el proyecto The Libreswan en el procesador de IKEv1 Los paquetes de intercambio informativo IKEv1 que están cifrados y protegidos por integridad utilizando las claves de integridad y cifrado IKE SA establecidas, pero como receptor, el valor de verificación de integridad no se verificó. Este problema afecta a las versiones anteriores a 3.29. A vulnerability was found in the Libreswan Project. • https://access.redhat.com/errata/RHSA-2019:3391 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10155 https://libreswan.org/security/CVE-2019-10155 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUEXFCN7FAYBKJBQJLYCEUQUCHDEJRZW https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFGPGLLKAXSLWFI62A6BZHTZSCHRCBXS https://access.redhat.com/security/cve/CVE-2019-10155 https://bugzilla.redhat.com/show_bug.cgi?id=1714141 • CWE-354: Improper Validation of Integrity Check Value •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-12312 – libreswan: null-pointer dereference by sending two IKEv2 packets
https://notcve.org/view.php?id=CVE-2019-12312
In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan. En Libreswan versión anterior a 3.28, un fallo de aserción puede llevar a un reinicio del componente pluto IKE daemon. Un atacante puede iniciar una desreferencia de puntero NULL enviando dos paquetes IKEv2 (init_IKE y delete_IKE) en modo 3des_cbc a un servidor Libreswan. • http://www.iwantacve.cn/index.php/archives/218 https://github.com/libreswan/libreswan/compare/9b1394e...3897683 https://github.com/libreswan/libreswan/issues/246 https://libreswan.org/security/CVE-2019-12312/CVE-2019-12312.txt https://libreswan.org/security/CVE-2019-12312/libreswan-3.27-CVE-2019-12312.patch https://access.redhat.com/security/cve/CVE-2019-12312 https://bugzilla.redhat.com/show_bug.cgi?id=1716918 • CWE-476: NULL Pointer Dereference CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2016-5391
https://notcve.org/view.php?id=CVE-2016-5391
libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon restart). Libreswan anterior a la 3.18 permite a un atacante remoto provocar una denegación de servicio (desreferencia a un puntero NULL y reinicio del daemon pluto). • https://bugzilla.redhat.com/show_bug.cgi?id=1356183 https://libreswan.org/security/CVE-2016-5391/CVE-2016-5391.txt https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65R6OA5AY7K2UBQUDOLOS5Y3SCULQI6I https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKMS7R4TG6LTAGEBOWVUXF6LAWQXLNXV • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-5361 – IKEv1 protocol is vulnerable to DoS amplification attack
https://notcve.org/view.php?id=CVE-2016-5361
programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each. programs/pluto/ikev1.c en libreswan en versiones anteriores a 3.17 retransmite en estados inicial-respuesta, lo que permite a atacantes remotos provocar una denegación de servicio (amplificación de tráfico) a través de un paquete UDP suplantado. NOTA: el comportamiento original cumple con el protocolo IKEv1, pero tiene una actualización de seguridad requerida por el vendedor de libreswan; a partir de 2016-06-10, se espera que otras varias implementaciones IKEv1 tengan actualizaciones de seguridad requeridas por el vendedor, con separadas CVEs IDs asignadas a cada una. A traffic amplification flaw was found in the Internet Key Exchange version 1 (IKEv1) protocol. A remote attacker could use a libreswan server with IKEv1 enabled in a network traffic amplification denial of service attack against other hosts on the network by sending UDP packets with a spoofed source address to that server. • http://rhn.redhat.com/errata/RHSA-2016-2603.html http://www.openwall.com/lists/oss-security/2016/06/10/4 https://github.com/libreswan/libreswan/commit/152d6d95632d8b9477c170f1de99bcd86d7fb1d6 https://lists.libreswan.org/pipermail/swan-dev/2016-March/001394.html https://access.redhat.com/security/cve/CVE-2016-5361 https://bugzilla.redhat.com/show_bug.cgi?id=1308508 • CWE-20: Improper Input Validation •