Lucene search
HistoryApr 16, 2014 - 6:37 p.m.
CVE-2014-2338
CVSS2
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
AI Score
6.6
Confidence
Low
EPSS
0.017
Percentile
87.8%
IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.
Affected configurations
Node
strongswanstrongswanMatch4.0.7
ORstrongswanstrongswanMatch4.1.0
ORstrongswanstrongswanMatch4.1.1
ORstrongswanstrongswanMatch4.1.2
ORstrongswanstrongswanMatch4.1.3
ORstrongswanstrongswanMatch4.1.4
ORstrongswanstrongswanMatch4.1.5
ORstrongswanstrongswanMatch4.1.6
ORstrongswanstrongswanMatch4.1.7
ORstrongswanstrongswanMatch4.1.8
ORstrongswanstrongswanMatch4.1.9
ORstrongswanstrongswanMatch4.1.10
ORstrongswanstrongswanMatch4.1.11
ORstrongswanstrongswanMatch4.2.0
ORstrongswanstrongswanMatch4.2.1
ORstrongswanstrongswanMatch4.2.2
ORstrongswanstrongswanMatch4.2.3
ORstrongswanstrongswanMatch4.2.4
ORstrongswanstrongswanMatch4.2.5
ORstrongswanstrongswanMatch4.2.6
ORstrongswanstrongswanMatch4.2.7
ORstrongswanstrongswanMatch4.2.8
ORstrongswanstrongswanMatch4.2.9
ORstrongswanstrongswanMatch4.2.10
ORstrongswanstrongswanMatch4.2.11
ORstrongswanstrongswanMatch4.2.12
ORstrongswanstrongswanMatch4.2.13
ORstrongswanstrongswanMatch4.2.14
ORstrongswanstrongswanMatch4.2.15
ORstrongswanstrongswanMatch4.2.16
ORstrongswanstrongswanMatch4.3.0
ORstrongswanstrongswanMatch4.3.1
ORstrongswanstrongswanMatch4.3.2
ORstrongswanstrongswanMatch4.3.3
ORstrongswanstrongswanMatch4.3.4
ORstrongswanstrongswanMatch4.3.5
ORstrongswanstrongswanMatch4.3.6
ORstrongswanstrongswanMatch4.3.7
ORstrongswanstrongswanMatch4.4.0
ORstrongswanstrongswanMatch4.4.1
ORstrongswanstrongswanMatch4.5.0
ORstrongswanstrongswanMatch4.5.1
ORstrongswanstrongswanMatch4.5.2
ORstrongswanstrongswanMatch4.5.3
ORstrongswanstrongswanMatch4.6.0
ORstrongswanstrongswanMatch4.6.1
ORstrongswanstrongswanMatch4.6.2
ORstrongswanstrongswanMatch4.6.3
ORstrongswanstrongswanMatch4.6.4
ORstrongswanstrongswanMatch5.0.0
ORstrongswanstrongswanMatch5.0.1
ORstrongswanstrongswanMatch5.0.2
ORstrongswanstrongswanMatch5.0.3
ORstrongswanstrongswanMatch5.0.4
ORstrongswanstrongswanMatch5.1.0
ORstrongswanstrongswanMatch5.1.1
ORstrongswanstrongswanMatch5.1.2
| Vendor | Product | Version | CPE |
|---|---|---|---|
| strongswan | strongswan | 4.0.7 | cpe:2.3:a:strongswan:strongswan:4.0.7:*:*:*:*:*:*:* |
| strongswan | strongswan | 4.1.0 | cpe:2.3:a:strongswan:strongswan:4.1.0:*:*:*:*:*:*:* |
| strongswan | strongswan | 4.1.1 | cpe:2.3:a:strongswan:strongswan:4.1.1:*:*:*:*:*:*:* |
| strongswan | strongswan | 4.1.2 | cpe:2.3:a:strongswan:strongswan:4.1.2:*:*:*:*:*:*:* |
| strongswan | strongswan | 4.1.3 | cpe:2.3:a:strongswan:strongswan:4.1.3:*:*:*:*:*:*:* |
| strongswan | strongswan | 4.1.4 | cpe:2.3:a:strongswan:strongswan:4.1.4:*:*:*:*:*:*:* |
| strongswan | strongswan | 4.1.5 | cpe:2.3:a:strongswan:strongswan:4.1.5:*:*:*:*:*:*:* |
| strongswan | strongswan | 4.1.6 | cpe:2.3:a:strongswan:strongswan:4.1.6:*:*:*:*:*:*:* |
| strongswan | strongswan | 4.1.7 | cpe:2.3:a:strongswan:strongswan:4.1.7:*:*:*:*:*:*:* |
| strongswan | strongswan | 4.1.8 | cpe:2.3:a:strongswan:strongswan:4.1.8:*:*:*:*:*:*:* |
References
lists.opensuse.org/opensuse-security-announce/2014-04/msg00010.html
lists.opensuse.org/opensuse-updates/2014-05/msg00064.html
lists.opensuse.org/opensuse-updates/2014-05/msg00066.html
secunia.com/advisories/57823
www.debian.org/security/2014/dsa-2903
www.securityfocus.com/bid/66815
www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html
Related
freebsd
freebsd
strongswan -- Remote Authentication Bypass
2014-03-12 00:00:00
suse
suse
Security update for strongswan (important)
2014-04-15 21:04:16
openvas
openvas
Debian Security Advisory DSA 2903-1 (strongswan - security update)
2014-04-14 00:00:00
SUSE: Security Advisory (SUSE-SU-2014:0529-1)
2021-06-09 00:00:00
SUSE: Security Advisory for strongswan (SUSE-SU-2014:0529-1)
2015-10-13 00:00:00
prion
prion
Authentication flaw
2014-04-16 18:37:00
seebug
seebug
strongSwan IKEv2 SAιͺθ―η»θΏζΌζ΄
2014-04-18 00:00:00
securityvulns
securityvulns
[SECURITY] [DSA 2903-1] strongswan security update
2014-05-04 00:00:00
Openswan / Strongswan security vulnerabilities
2014-05-07 00:00:00
cve
cve
CVE-2014-2338
2014-04-16 18:37:14
nessus
nessus
FreeBSD : strongswan -- Remote Authentication Bypass (6fb521b0-d388-11e3-a790-000c2980a9f3)
2014-05-05 00:00:00
SuSE 11.3 Security Update : strongswan (SAT Patch Number 9089)
2014-04-16 00:00:00
Fedora 20 : strongswan-5.1.3-1.fc20 (2014-5231)
2014-04-25 00:00:00
debian
debian
[SECURITY] [DSA 2903-1] strongswan security update
2014-04-14 15:01:29
cvelist
cvelist
CVE-2014-2338
2014-04-16 18:00:00
ubuntucve
ubuntucve
CVE-2014-2338
2014-04-16 00:00:00
debiancve
debiancve
CVE-2014-2338
2014-04-16 18:37:14
osv
osv
strongswan - security update
2014-04-14 00:00:00
strongswan-5.3.5-1.1 on GA media
2024-06-15 00:00:00
gentoo
gentoo
strongSwan: Multiple Vulnerabilities
2014-12-13 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: strongswan-5.1.3-1.fc20
2014-04-24 07:35:30
[SECURITY] Fedora 19 Update: strongswan-5.1.3-1.fc19
2014-04-24 07:41:29
CVSS2
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
AI Score
6.6
Confidence
Low
EPSS
0.017
Percentile
87.8%
Related for NVD:CVE-2014-2338