CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15836
https://notcve.org/view.php?id=CVE-2018-15836
In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used. IKEv2 signature verification is affected when RAW RSA keys are used. En Openswan en versiones anteriores a la 2.6.50.1, la verificación de firmas IKEv2 es vulnerable a "variantes de ataques de bajo exponente de Bleichenbacher en firmas RSA PKCS#1" cuando se emplean claves RSA RAW. • https://github.com/xelerance/Openswan/commit/0b460be9e287fd335c8ce58129c67bf06065ef51 https://github.com/xelerance/Openswan/commit/9eaa6c2a823c1d2b58913506a15f9474bf857a3d https://lists.openswan.org/pipermail/users/2018-August/023761.html • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 5.0EPSS: 2%CPEs: 76EXPL: 0CVE-2013-6466 – openswan: dereferencing missing IKEv2 payloads causes pluto daemon to restart
https://notcve.org/view.php?id=CVE-2013-6466
Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. Openswan v2.6.39 y anteriores permite a atacantes remotos provocar una denegación de servicio (referencia a puntero nulo y reinicio del demonio IKE) a través de paquetes IKEv2 que cuenten con payloads esperados. • http://rhn.redhat.com/errata/RHSA-2014-0185.html http://www.debian.org/security/2014/dsa-2893 http://www.securityfocus.com/bid/65155 https://cert.vde.com/en-us/advisories/vde-2017-001 https://exchange.xforce.ibmcloud.com/vulnerabilities/90524 https://libreswan.org/security/CVE-2013-6467/CVE-2013-6467.txt https://access.redhat.com/security/cve/CVE-2013-6466 https://bugzilla.redhat.com/show_bug.cgi?id=1050277 •
CVSS: 7.6EPSS: 7%CPEs: 38EXPL: 0CVE-2013-2053 – Openswan: remote buffer overflow in atodn()
https://notcve.org/view.php?id=CVE-2013-2053
Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be the same vulnerability as CVE-2013-2052 and CVE-2013-2054. Desbordamiento de buffer en la función atodn en Openswan anteriores a v2.6.39, cuando está activada Opportunistic Encryptiony se usa una clave RSA, permite a los atacantes remotos provocar una denegación de servicio (caída del demonio IKE)y posiblemente ejecutar código a través de registros DNS TXT. Nota: esta podría ser la misma vulnerabilidad que CVE-2013-2052 y CVE-2013-2054. • http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00008.html http://rhn.redhat.com/errata/RHSA-2013-0827.html http://www.debian.org/security/2014/dsa-2893 http://www.securityfocus.com/bid/59838 https://bugzilla.redhat.com/show_bug.cgi?id=960229 https://lists.libreswan.org/pipermail/swan-announce/2013/000003.html https://www.openswan.org/news/13 https://access.redhat.com/security/cve/CVE-2013-2053 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.0EPSS: 1%CPEs: 73EXPL: 0CVE-2011-4073 – openswan: use-after-free vulnerability leads to DoS
https://notcve.org/view.php?id=CVE-2011-4073
Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through 2.6.36 allows remote authenticated users to cause a denial of service (pluto IKE daemon crash) via vectors related to the (1) quick_outI1_continue and (2) quick_outI1 functions. Una vulnerabilidad de uso de memoria previamente liberada en la funcionalidad del manejador auxiliar criptográfico en Openswan versión 2.3.0 hasta 2.6.36, permite a los usuarios autenticados remotos causar una denegación de servicio (bloqueo del demonio pluto IKE) por medio de vectores relacionados con las funciones (1) quick_outI1_continue y (2) quick_outI1. • http://secunia.com/advisories/46678 http://secunia.com/advisories/46681 http://secunia.com/advisories/47342 http://www.debian.org/security/2011/dsa-2374 http://www.openswan.org/download/CVE-2011-4073/CVE-2011-4073.txt http://www.redhat.com/support/errata/RHSA-2011-1422.html http://www.securityfocus.com/bid/50440 http://www.securitytracker.com/id?1026268 https://access.redhat.com/security/cve/CVE-2011-4073 https://bugzilla.redhat.com/show_bug.cgi?id=748961 • CWE-399: Resource Management Errors CWE-416: Use After Free •
CVSS: 5.0EPSS: 8%CPEs: 56EXPL: 0CVE-2009-2185 – Openswan ASN.1 parser vulnerability
https://notcve.org/view.php?id=CVE-2009-2185
The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string. El analizador ASN.1 pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) en (a) strongSwan v2.8 anterior a v2.8.10, v4.2 anterior a v4.2.16, y v4.3 anterior a v4.3.2; y (b) openSwan v2.6 anterior a v2.6.22 y v2.4 anterior a v2.4.15 permite a atacantes remotos provocar una denegación de servicio (caída del demonio IKE pluto) a través de un certificado X.509 con (1) Nombres Caracterizados Relativos (RDNs) (2) una cadena UTCTIME manipulada, o (3) una cadena GENERALIZEDTIME manipulada. • http://download.strongswan.org/CHANGES2.txt http://download.strongswan.org/CHANGES4.txt http://download.strongswan.org/CHANGES42.txt http://secunia.com/advisories/35522 http://secunia.com/advisories/35698 http://secunia.com/advisories/35740 http://secunia.com/advisories/35804 http://secunia.com/advisories/36922 http://secunia.com/advisories/36950 http://secunia.com/advisories/37504 http://up2date.astaro.com/2009/07/up2date_7404_released.html http://www.debian.org/security/2009/ • CWE-20: Improper Input Validation •