Security Bulletin: Vulnerabilities in Strongswan affect Power Hardware Management Console (CVE-2014-9221,CVE-2014-2891,CVE-2014-2338,CVE-2013-5018)

Summary

Strongswan is used by Power Hardware Management Console (HMC). HMC has addressed the applicable CVEs.

Vulnerability Details

CVEID: CVE-2014-9221**
DESCRIPTION:** strongSwan is vulnerable to a denial of service, caused by a NULL pointer dereference when handling malicious payloads. A remote attacker could exploit this vulnerability using a specially-crafted IKEv2 Key Exchange (KE) payload with Diffie-Hellman (DH) group 1025 to cause the IKE daemon to crash.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/102742 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-2891**
DESCRIPTION:** strongSwan is vulnerable to a denial of service, caused by a NULL pointer dereference when handling malicious payloads. A remote attacker could exploit this vulnerability using a specially-crafted ID_DER_ASN1_DN ID payload to cause the IKE daemon to crash.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/93058 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2014-2338**
DESCRIPTION:** strongSwan could allow a remote attacker to bypass security restrictions, caused by an error in the process_request() function when rekeying an unestablished IKEv2 SA. An attacker could exploit this vulnerability to gain unauthorized access to the system without providing valid authentication credentials.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/92590 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVEID: CVE-2013-5018**
DESCRIPTION:** strongSwan is vulnerable to a denial of service, caused by an error in the is_asn1() function. A remote attacker could exploit this vulnerability using specially-crafted requests to cause the application to crash.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/#/vulnerabilities/86125 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

Power HMC V8.1.0.0
Power HMC V8.2.0.0
Power HMC V8.3.0.0

Remediation/Fixes

The following fixes are available on IBM Fix Central at: <http://www-933.ibm.com/support/fixcentral/&gt;

Product

|

VRMF

|

APAR

|

Remediation/Fix

—|—|—|—

Power HMC

|

V8.8.1.0 SP2

|

MB03938

|

Apply eFix MH01550

Power HMC

|

V8.8.2.0 SP2

|

MB03873

|

Apply eFix MH01488

Power HMC

|

V8.8.3.0

|

MB03939

|

Apply eFix MH01551

Workarounds and Mitigations

None