[SECURITY] [DLA 345-1] strongswan security update

2015-11-1912:46:30

lists.debian.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.005 Low

EPSS

Percentile

76.9%

JSON

Package : strongswan
Version : 4.4.1-5.8
CVE ID : CVE-2015-8023

Tobias Brunner found an authentication bypass vulnerability in
strongSwan, an IKE/IPsec suite.

Due to insufficient validation of its local state the server
implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin
can be tricked into successfully concluding the authentication without
providing valid credentials.

It's possible to recognize such attacks by looking at the server logs.
The following log message would be seen during the client
authentication:

EAP method EAP_MSCHAPV2 succeeded, no MSK established

OSVersionArchitecturePackageVersionFilename
Debian8kfreebsd-i386libstrongswan-extra-plugins< 5.2.1-6+deb8u2libstrongswan-extra-plugins_5.2.1-6+deb8u2_kfreebsd-i386.deb
Debian8amd64strongswan-starter< 5.2.1-6+deb8u2strongswan-starter_5.2.1-6+deb8u2_amd64.deb
Debian8s390xstrongswan-charon< 5.2.1-6+deb8u2strongswan-charon_5.2.1-6+deb8u2_s390x.deb
Debian7i386libstrongswan< 4.5.2-1.5+deb7u8libstrongswan_4.5.2-1.5+deb7u8_i386.deb
Debian8s390xlibstrongswan-standard-plugins< 5.2.1-6+deb8u2libstrongswan-standard-plugins_5.2.1-6+deb8u2_s390x.deb
Debian8mipsellibstrongswan< 5.2.1-6+deb8u2libstrongswan_5.2.1-6+deb8u2_mipsel.deb
Debian7s390strongswan-ikev1< 4.5.2-1.5+deb7u8strongswan-ikev1_4.5.2-1.5+deb7u8_s390.deb
Debian8mipslibcharon-extra-plugins< 5.2.1-6+deb8u2libcharon-extra-plugins_5.2.1-6+deb8u2_mips.deb
Debian8s390xstrongswan-libcharon< 5.2.1-6+deb8u2strongswan-libcharon_5.2.1-6+deb8u2_s390x.deb
Debian8mipsellibstrongswan-extra-plugins< 5.2.1-6+deb8u2libstrongswan-extra-plugins_5.2.1-6+deb8u2_mipsel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	kfreebsd-i386	libstrongswan-extra-plugins	< 5.2.1-6+deb8u2	libstrongswan-extra-plugins_5.2.1-6+deb8u2_kfreebsd-i386.deb
Debian	8	amd64	strongswan-starter	< 5.2.1-6+deb8u2	strongswan-starter_5.2.1-6+deb8u2_amd64.deb
Debian	8	s390x	strongswan-charon	< 5.2.1-6+deb8u2	strongswan-charon_5.2.1-6+deb8u2_s390x.deb
Debian	7	i386	libstrongswan	< 4.5.2-1.5+deb7u8	libstrongswan_4.5.2-1.5+deb7u8_i386.deb
Debian	8	s390x	libstrongswan-standard-plugins	< 5.2.1-6+deb8u2	libstrongswan-standard-plugins_5.2.1-6+deb8u2_s390x.deb
Debian	8	mipsel	libstrongswan	< 5.2.1-6+deb8u2	libstrongswan_5.2.1-6+deb8u2_mipsel.deb
Debian	7	s390	strongswan-ikev1	< 4.5.2-1.5+deb7u8	strongswan-ikev1_4.5.2-1.5+deb7u8_s390.deb
Debian	8	mips	libcharon-extra-plugins	< 5.2.1-6+deb8u2	libcharon-extra-plugins_5.2.1-6+deb8u2_mips.deb
Debian	8	s390x	strongswan-libcharon	< 5.2.1-6+deb8u2	strongswan-libcharon_5.2.1-6+deb8u2_s390x.deb
Debian	8	mipsel	libstrongswan-extra-plugins	< 5.2.1-6+deb8u2	libstrongswan-extra-plugins_5.2.1-6+deb8u2_mipsel.deb