-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2789-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Yves-Alexis Perez November 01, 2013 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : strongswan Vulnerability : Denial of service and authorization bypass Problem type : remote Debian-specific: no CVE ID : CVE-2013-6075 A vulnerability has been found in the ASN.1 parser of strongSwan, an IKE daemon used to establish IPsec protected links. By sending a crafted ID_DER_ASN1_DN ID payload to a vulnerable pluto or charon daemon, a malicious remote user can provoke a denial of service (daemon crash) or an authorization bypass (impersonating a different user, potentially acquiring VPN permissions she doesn't have). For the oldstable distribution (squeeze), this problem has been fixed in version 4.4.1-5.4. For the stable distribution (wheezy), this problem has been fixed in version 4.5.2-1.5+deb7u2. For the testing distribution (jessie), this problem has been fixed in version 5.1.0-3. For the unstable distribution (sid), this problem has been fixed in version 5.1.0-3. We recommend that you upgrade your strongswan packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
Debian: DSA-2789-1: strongswan security update
A vulnerability has been found in the ASN.1 parser of strongSwan, an IKE daemon used to establish IPsec protected links. By sending a crafted ID_DER_ASN1_DN ID payload to a vulnerable pluto or
