CVE-2009-2661
CVE-2009-2661
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
EPSS 1.6% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
strongswan Debian:12
- Affected ranges
- ECOSYSTEM: < 4.3.2-1.1
Update to 4.3.2-1.1
strongswan Debian:13
- Affected ranges
- ECOSYSTEM: < 4.3.2-1.1
Update to 4.3.2-1.1
strongswan Debian:14
- Affected ranges
- ECOSYSTEM: < 4.3.2-1.1
Update to 4.3.2-1.1
Original sources
- http://www.openwall.com/lists/oss-security/2009/07/27/1
- http://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.x.x_asn1_length.patch
- http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
- http://secunia.com/advisories/36922
- http://www.debian.org/security/2009/dsa-1899
- http://www.vupen.com/english/advisories/2009/2247
- http://up2date.astaro.com/2009/08/up2date_7505_released.html
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
- http://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.3.x_asn1_length.patch
- https://lists.strongswan.org/pipermail/announce/2009-July/000056.html
- https://nvd.nist.gov/vuln/detail/CVE-2009-2661