CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15836
https://notcve.org/view.php?id=CVE-2018-15836
In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used. IKEv2 signature verification is affected when RAW RSA keys are used. En Openswan en versiones anteriores a la 2.6.50.1, la verificación de firmas IKEv2 es vulnerable a "variantes de ataques de bajo exponente de Bleichenbacher en firmas RSA PKCS#1" cuando se emplean claves RSA RAW. • https://github.com/xelerance/Openswan/commit/0b460be9e287fd335c8ce58129c67bf06065ef51 https://github.com/xelerance/Openswan/commit/9eaa6c2a823c1d2b58913506a15f9474bf857a3d https://lists.openswan.org/pipermail/users/2018-August/023761.html • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 5.0EPSS: 2%CPEs: 76EXPL: 0CVE-2013-6466 – openswan: dereferencing missing IKEv2 payloads causes pluto daemon to restart
https://notcve.org/view.php?id=CVE-2013-6466
Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. Openswan v2.6.39 y anteriores permite a atacantes remotos provocar una denegación de servicio (referencia a puntero nulo y reinicio del demonio IKE) a través de paquetes IKEv2 que cuenten con payloads esperados. • http://rhn.redhat.com/errata/RHSA-2014-0185.html http://www.debian.org/security/2014/dsa-2893 http://www.securityfocus.com/bid/65155 https://cert.vde.com/en-us/advisories/vde-2017-001 https://exchange.xforce.ibmcloud.com/vulnerabilities/90524 https://libreswan.org/security/CVE-2013-6467/CVE-2013-6467.txt https://access.redhat.com/security/cve/CVE-2013-6466 https://bugzilla.redhat.com/show_bug.cgi?id=1050277 •
CVSS: 7.6EPSS: 7%CPEs: 38EXPL: 0CVE-2013-2053 – Openswan: remote buffer overflow in atodn()
https://notcve.org/view.php?id=CVE-2013-2053
Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be the same vulnerability as CVE-2013-2052 and CVE-2013-2054. Desbordamiento de buffer en la función atodn en Openswan anteriores a v2.6.39, cuando está activada Opportunistic Encryptiony se usa una clave RSA, permite a los atacantes remotos provocar una denegación de servicio (caída del demonio IKE)y posiblemente ejecutar código a través de registros DNS TXT. Nota: esta podría ser la misma vulnerabilidad que CVE-2013-2052 y CVE-2013-2054. • http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00008.html http://rhn.redhat.com/errata/RHSA-2013-0827.html http://www.debian.org/security/2014/dsa-2893 http://www.securityfocus.com/bid/59838 https://bugzilla.redhat.com/show_bug.cgi?id=960229 https://lists.libreswan.org/pipermail/swan-announce/2013/000003.html https://www.openswan.org/news/13 https://access.redhat.com/security/cve/CVE-2013-2053 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 2%CPEs: 2EXPL: 0CVE-2005-0162
https://notcve.org/view.php?id=CVE-2005-0162
Stack-based buffer overflow in the get_internal_addresses function in the pluto application for Openswan 1.x before 1.0.9, and Openswan 2.x before 2.3.0, when compiled with XAUTH and PAM enabled, allows remote authenticated attackers to execute arbitrary code. • http://secunia.com/advisories/14038 http://secunia.com/advisories/14062 http://securitytracker.com/id?1013014 http://www.idefense.com/application/poi/display?id=190&type=vulnerabilities http://www.openswan.org/support/vuln/IDEF0785 http://www.osvdb.org/13195 http://www.redhat.com/archives/fedora-announce-list/2005-January/msg00103.html http://www.securityfocus.com/bid/12377 https://exchange.xforce.ibmcloud.com/vulnerabilities/19078 •
CVSS: 10.0EPSS: 1%CPEs: 6EXPL: 0CVE-2004-0590
https://notcve.org/view.php?id=CVE-2004-0590
FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x before 2.1.4, and strongSwan before 2.1.3, allows remote attackers to authenticate using spoofed PKCS#7 certificates in which a self-signed certificate identifies an alternate Certificate Authority (CA) and spoofed issuer and subject. FreeS/WAN 1.x y 2.x, y otros productos relacionados, incluyendo superfreeswan 1.x, openswan 1.x anteriores a 1.0.6, openswan 2.x anteriores a 2.1.4 y strongSwan anteriores a 2.1.3 permite a atacantes remotos autenticarse usando certificados PKCS#7 falsificados en los que un certificado auto-firmado identifica a una Autoridad Certificadora (CA) y a un usuario y asunto suplantados. • http://security.gentoo.org/glsa/glsa-200406-20.xml http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:070 http://www.openswan.org/support/vuln/can-2004-0590 https://exchange.xforce.ibmcloud.com/vulnerabilities/16515 •