Authentication flaw

2015-11-1816:59:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.005 Low

EPSS

Percentile

76.5%

JSON

The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.

CPENameOperatorVersion
ubuntu_linuxeq15.10
ubuntu_linuxeq14.04
ubuntu_linuxeq15.04
strongswaneq5.2.3
strongswaneq4.3.7
strongswaneq4.2.12
strongswaneq5.1.2
strongswaneq4.2.16
strongswaneq4.5.3
strongswaneq4.5.2

Name	Operator	Version
ubuntu_linux	eq	15.10
ubuntu_linux	eq	14.04
ubuntu_linux	eq	15.04
strongswan	eq	5.2.3
strongswan	eq	4.3.7
strongswan	eq	4.2.12
strongswan	eq	5.1.2
strongswan	eq	4.2.16
strongswan	eq	4.5.3
strongswan	eq	4.5.2