Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 439
Alerts This Week
Warning Icon 1 439

Ubuntu 17.04: USN-3397-1 Moderate Advisory for strongSwan DoS Vulnerability

ubuntu
Calendar Grey August 21, 2017
Scroller Ubuntu
A critical strongSwan flaw impacts several Ubuntu releases, enabling crashes via malicious packets. Immediate patching is advised.
strongSwan could be made to crash or hang if it received specially crafted network traffic.

Summary

strongSwan could be made to crash or hang if it received specially

crafted network traffic.

Software Description:

- strongswan: IPsec VPN solution

Details:

It was discovered that strongSwan incorrectly handled verifying

specific RSA signatures. A remote attacker could use this issue

to cause strongSwan to crash, resulting in a denial of service.

Topics%20covered

Topics Covered

security advisory denial of service software update Ubuntu LTS strongSwan

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  libstrongswan                   5.5.1-1ubuntu3.2
  strongswan                      5.5.1-1ubuntu3.2

Ubuntu 16.04 LTS:
  libstrongswan                   5.3.5-1ubuntu3.4
  strongswan                      5.3.5-1ubuntu3.4

Ubuntu 14.04 LTS:
  libstrongswan                   5.1.2-0ubuntu2.7
  strongswan                      5.1.2-0ubuntu2.7

In general, a standard system update will make all the necessary
changes.

References

 

  CVE-2017-11185

Severity
important
Lowest
Low
Medium
High
Critical

August 21, 2017

Topics%20covered

Topics Covered

security advisory denial of service software update Ubuntu LTS strongSwan

Package Information

  https://launchpad.net/ubuntu/+source/strongswan/5.5.1-1ubuntu3.2
  https://launchpad.net/ubuntu/+source/strongswan/5.3.5-1ubuntu3.4
  https://launchpad.net/ubuntu/+source/strongswan/5.1.2-0ubuntu2.7

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.