CVE-2013-2053

Openswan: remote buffer overflow in atodn()

Severity Score

9.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be the same vulnerability as CVE-2013-2052 and CVE-2013-2054.

Desbordamiento de buffer en la función atodn en Openswan anteriores a v2.6.39, cuando está activada Opportunistic Encryptiony se usa una clave RSA, permite a los atacantes remotos provocar una denegación de servicio (caída del demonio IKE)y posiblemente ejecutar código a través de registros DNS TXT. Nota: esta podría ser la misma vulnerabilidad que CVE-2013-2052 y CVE-2013-2054.

Multiple vulnerabilities has been discovered and corrected in openswan. The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the in many distributions and the upstream version, this tool has been disabled. The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted R_U_THERE_ACK Dead Peer Detection IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD. Various other issues have also been addressed.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-02-19 CVE Reserved
2013-07-09 CVE Published
2024-08-06 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (8)

URL	Tag	Source
http://www.securityfocus.com/bid/59838	Vdb Entry
https://lists.libreswan.org/pipermail/swan-announce/2013/000003.html	Mailing List

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00008.html	2023-11-07
http://rhn.redhat.com/errata/RHSA-2013-0827.html	2023-11-07
http://www.debian.org/security/2014/dsa-2893	2023-11-07
https://bugzilla.redhat.com/show_bug.cgi?id=960229	2013-05-15
https://www.openswan.org/news/13	2023-11-07
https://access.redhat.com/security/cve/CVE-2013-2053	2013-05-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				<= 2.6.38 Search vendor "Xelerance" for product "Openswan" and version " <= 2.6.38"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.01 Search vendor "Xelerance" for product "Openswan" and version "2.6.01"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.02 Search vendor "Xelerance" for product "Openswan" and version "2.6.02"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.03 Search vendor "Xelerance" for product "Openswan" and version "2.6.03"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.04 Search vendor "Xelerance" for product "Openswan" and version "2.6.04"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.05 Search vendor "Xelerance" for product "Openswan" and version "2.6.05"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.06 Search vendor "Xelerance" for product "Openswan" and version "2.6.06"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.07 Search vendor "Xelerance" for product "Openswan" and version "2.6.07"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.08 Search vendor "Xelerance" for product "Openswan" and version "2.6.08"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.09 Search vendor "Xelerance" for product "Openswan" and version "2.6.09"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.10 Search vendor "Xelerance" for product "Openswan" and version "2.6.10"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.11 Search vendor "Xelerance" for product "Openswan" and version "2.6.11"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.12 Search vendor "Xelerance" for product "Openswan" and version "2.6.12"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.13 Search vendor "Xelerance" for product "Openswan" and version "2.6.13"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.14 Search vendor "Xelerance" for product "Openswan" and version "2.6.14"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.15 Search vendor "Xelerance" for product "Openswan" and version "2.6.15"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.16 Search vendor "Xelerance" for product "Openswan" and version "2.6.16"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.17 Search vendor "Xelerance" for product "Openswan" and version "2.6.17"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.18 Search vendor "Xelerance" for product "Openswan" and version "2.6.18"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.19 Search vendor "Xelerance" for product "Openswan" and version "2.6.19"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.20 Search vendor "Xelerance" for product "Openswan" and version "2.6.20"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.21 Search vendor "Xelerance" for product "Openswan" and version "2.6.21"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.22 Search vendor "Xelerance" for product "Openswan" and version "2.6.22"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.23 Search vendor "Xelerance" for product "Openswan" and version "2.6.23"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.24 Search vendor "Xelerance" for product "Openswan" and version "2.6.24"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.25 Search vendor "Xelerance" for product "Openswan" and version "2.6.25"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.26 Search vendor "Xelerance" for product "Openswan" and version "2.6.26"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.27 Search vendor "Xelerance" for product "Openswan" and version "2.6.27"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.28 Search vendor "Xelerance" for product "Openswan" and version "2.6.28"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.29 Search vendor "Xelerance" for product "Openswan" and version "2.6.29"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.30 Search vendor "Xelerance" for product "Openswan" and version "2.6.30"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.31 Search vendor "Xelerance" for product "Openswan" and version "2.6.31"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.32 Search vendor "Xelerance" for product "Openswan" and version "2.6.32"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.33 Search vendor "Xelerance" for product "Openswan" and version "2.6.33"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.34 Search vendor "Xelerance" for product "Openswan" and version "2.6.34"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.35 Search vendor "Xelerance" for product "Openswan" and version "2.6.35"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.36 Search vendor "Xelerance" for product "Openswan" and version "2.6.36"		-		Affected
Xelerance Search vendor "Xelerance"		Openswan Search vendor "Xelerance" for product "Openswan"				2.6.37 Search vendor "Xelerance" for product "Openswan" and version "2.6.37"		-		Affected