Ubuntu 17.04 Advisory USN-3301-1: Critical strongSwan Network Threat

ubuntu

May 30, 2017

strongSwan could be made to crash or hang if it received specially crafted network traffic.

Summary

strongSwan could be made to crash or hang if it received specially crafted

network traffic.

Software Description:

- strongswan: IPsec VPN solution

Details:

It was discovered that the strongSwan gmp plugin incorrectly validated RSA

public keys. A remote attacker could use this issue to cause strongSwan to

crash, resulting in a denial of service. (CVE-2017-9022)

It was discovered that strongSwan incorrectly parsed ASN.1 CHOICE types. A

remote attacker could use this issue to cause strongSwan to hang, resulting

in a denial of service. (CVE-2017-9023)

Topics Covered

security advisory denial of service security update Ubuntu software fix network threat strongswan

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  libstrongswan                   5.5.1-1ubuntu3.1
  strongswan                      5.5.1-1ubuntu3.1

Ubuntu 16.10:
  libstrongswan                   5.3.5-1ubuntu4.3
  strongswan                      5.3.5-1ubuntu4.3
  strongswan-plugin-gmp           5.3.5-1ubuntu4.3

Ubuntu 16.04 LTS:
  libstrongswan                   5.3.5-1ubuntu3.3
  strongswan                      5.3.5-1ubuntu3.3
  strongswan-plugin-gmp           5.3.5-1ubuntu3.3

Ubuntu 14.04 LTS:
  libstrongswan                   5.1.2-0ubuntu2.6
  strongswan                      5.1.2-0ubuntu2.6
  strongswan-plugin-gmp           5.1.2-0ubuntu2.6

In general, a standard system update will make all the necessary changes.