CVE-2009-2185

Openswan ASN.1 parser vulnerability

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

El analizador ASN.1 pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) en (a) strongSwan v2.8 anterior a v2.8.10, v4.2 anterior a v4.2.16, y v4.3 anterior a v4.3.2; y (b) openSwan v2.6 anterior a v2.6.22 y v2.4 anterior a v2.4.15 permite a atacantes remotos provocar una denegación de servicio (caída del demonio IKE pluto) a través de un certificado X.509 con (1) Nombres Caracterizados Relativos (RDNs) (2) una cadena UTCTIME manipulada, o (3) una cadena GENERALIZEDTIME manipulada.

*Credits: N/A

CVSS Scores

NISTv2 5.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-06-24 CVE Reserved
2009-06-24 CVE Published
2024-08-07 CVE Updated
2024-10-21 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (26)

URL	Tag	Source
http://secunia.com/advisories/35698	Third Party Advisory
http://secunia.com/advisories/35740	Third Party Advisory
http://secunia.com/advisories/35804	Third Party Advisory
http://secunia.com/advisories/36922	Third Party Advisory
http://secunia.com/advisories/36950	Third Party Advisory
http://secunia.com/advisories/37504	Third Party Advisory
http://up2date.astaro.com/2009/07/up2date_7404_released.html	X_refsource_confirm
http://www.ingate.com/Relnote.php?ver=481	X_refsource_confirm
http://www.securitytracker.com/id?1022428	Vdb Entry
http://www.vupen.com/english/advisories/2009/1706	Vdb Entry
http://www.vupen.com/english/advisories/2009/1829	Vdb Entry
http://www.vupen.com/english/advisories/2009/3354	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11079	Signature

URL	Date	SRC

URL	Date	SRC
http://www.securityfocus.com/bid/35452	2019-07-29

URL	Date	SRC
http://download.strongswan.org/CHANGES2.txt	2019-07-29
http://download.strongswan.org/CHANGES4.txt	2019-07-29
http://download.strongswan.org/CHANGES42.txt	2019-07-29
http://secunia.com/advisories/35522	2019-07-29
http://www.debian.org/security/2009/dsa-1898	2019-07-29
http://www.debian.org/security/2009/dsa-1899	2019-07-29
http://www.redhat.com/support/errata/RHSA-2009-1138.html	2019-07-29
http://www.vupen.com/english/advisories/2009/1639	2019-07-29
https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00264.html	2019-07-29
https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00337.html	2019-07-29
https://access.redhat.com/security/cve/CVE-2009-2185	2009-07-02
https://bugzilla.redhat.com/show_bug.cgi?id=507362	2009-07-02

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				2.8.0 Search vendor "Strongswan" for product "Strongswan" and version "2.8.0"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				2.8.1 Search vendor "Strongswan" for product "Strongswan" and version "2.8.1"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				2.8.2 Search vendor "Strongswan" for product "Strongswan" and version "2.8.2"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				2.8.3 Search vendor "Strongswan" for product "Strongswan" and version "2.8.3"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				2.8.4 Search vendor "Strongswan" for product "Strongswan" and version "2.8.4"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				2.8.5 Search vendor "Strongswan" for product "Strongswan" and version "2.8.5"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				2.8.6 Search vendor "Strongswan" for product "Strongswan" and version "2.8.6"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				2.8.7 Search vendor "Strongswan" for product "Strongswan" and version "2.8.7"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				2.8.8 Search vendor "Strongswan" for product "Strongswan" and version "2.8.8"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				2.8.9 Search vendor "Strongswan" for product "Strongswan" and version "2.8.9"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				2.8.10 Search vendor "Strongswan" for product "Strongswan" and version "2.8.10"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.1 Search vendor "Strongswan" for product "Strongswan" and version "4.1"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.0 Search vendor "Strongswan" for product "Strongswan" and version "4.2.0"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.1 Search vendor "Strongswan" for product "Strongswan" and version "4.2.1"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.2 Search vendor "Strongswan" for product "Strongswan" and version "4.2.2"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.3 Search vendor "Strongswan" for product "Strongswan" and version "4.2.3"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.4 Search vendor "Strongswan" for product "Strongswan" and version "4.2.4"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.5 Search vendor "Strongswan" for product "Strongswan" and version "4.2.5"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.6 Search vendor "Strongswan" for product "Strongswan" and version "4.2.6"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.7 Search vendor "Strongswan" for product "Strongswan" and version "4.2.7"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.8 Search vendor "Strongswan" for product "Strongswan" and version "4.2.8"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.9 Search vendor "Strongswan" for product "Strongswan" and version "4.2.9"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.10 Search vendor "Strongswan" for product "Strongswan" and version "4.2.10"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.11 Search vendor "Strongswan" for product "Strongswan" and version "4.2.11"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.12 Search vendor "Strongswan" for product "Strongswan" and version "4.2.12"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.13 Search vendor "Strongswan" for product "Strongswan" and version "4.2.13"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.14 Search vendor "Strongswan" for product "Strongswan" and version "4.2.14"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.2.15 Search vendor "Strongswan" for product "Strongswan" and version "4.2.15"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.3.0 Search vendor "Strongswan" for product "Strongswan" and version "4.3.0"		-		Affected
Strongswan Search vendor "Strongswan"		Strongswan Search vendor "Strongswan" for product "Strongswan"				4.3.1 Search vendor "Strongswan" for product "Strongswan" and version "4.3.1"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.4.0 Search vendor "Xelerance" for product "Openswan" and version "2.4.0"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.4.1 Search vendor "Xelerance" for product "Openswan" and version "2.4.1"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.4.2 Search vendor "Xelerance" for product "Openswan" and version "2.4.2"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.4.3 Search vendor "Xelerance" for product "Openswan" and version "2.4.3"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.4.4 Search vendor "Xelerance" for product "Openswan" and version "2.4.4"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.4.5 Search vendor "Xelerance" for product "Openswan" and version "2.4.5"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.4.9 Search vendor "Xelerance" for product "Openswan" and version "2.4.9"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.4.10 Search vendor "Xelerance" for product "Openswan" and version "2.4.10"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.03 Search vendor "Xelerance" for product "Openswan" and version "2.6.03"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.04 Search vendor "Xelerance" for product "Openswan" and version "2.6.04"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.05 Search vendor "Xelerance" for product "Openswan" and version "2.6.05"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.06 Search vendor "Xelerance" for product "Openswan" and version "2.6.06"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.07 Search vendor "Xelerance" for product "Openswan" and version "2.6.07"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.08 Search vendor "Xelerance" for product "Openswan" and version "2.6.08"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.09 Search vendor "Xelerance" for product "Openswan" and version "2.6.09"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.10 Search vendor "Xelerance" for product "Openswan" and version "2.6.10"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.11 Search vendor "Xelerance" for product "Openswan" and version "2.6.11"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.12 Search vendor "Xelerance" for product "Openswan" and version "2.6.12"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.13 Search vendor "Xelerance" for product "Openswan" and version "2.6.13"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.14 Search vendor "Xelerance" for product "Openswan" and version "2.6.14"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.15 Search vendor "Xelerance" for product "Openswan" and version "2.6.15"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.16 Search vendor "Xelerance" for product "Openswan" and version "2.6.16"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.17 Search vendor "Xelerance" for product "Openswan" and version "2.6.17"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.18 Search vendor "Xelerance" for product "Openswan" and version "2.6.18"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.19 Search vendor "Xelerance" for product "Openswan" and version "2.6.19"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.20 Search vendor "Xelerance" for product "Openswan" and version "2.6.20"		-		Affected