124 matches found
CVE-2018-16152: Improper Verification of Cryptographic Signature
In verifyemsapkcs1signature in gmprsapublickey.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS1 v1.5 signature verification. Consequently, a remote attacker can forge...
USN-3771-1 strongswan vulnerabilities
It was discovered that strongSwan incorrectly handled IKEv2 key derivation. A remote attacker could possibly use this issue to cause strongSwan to crash, resulting in a denial of service. CVE-2018-10811 Sze Yiu Chau discovered that strongSwan incorrectly handled parsing OIDs in the gmp plugin. A...
USN-3771-1: strongSwan vulnerabilities
It was discovered that strongSwan incorrectly handled IKEv2 key derivation. A remote attacker could possibly use this issue to cause strongSwan to crash, resulting in a denial of service. CVE-2018-10811 Sze Yiu Chau discovered that strongSwan incorrectly handled parsing OIDs in the gmp plugin. A...
Debian DSA-4305-1 : strongswan - security update
Sze Yiu Chau and his team from Purdue University and The University of Iowa found several issues in the gmp plugin for strongSwan, an IKE/IPsec suite. Problems in the parsing and verification of RSA signatures could lead to a Bleichenbacher-style low-exponent signature forgery in certificates and...
CVE-2018-16152
In verifyemsapkcs1signature in gmprsapublickey.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS1 v1.5 signature verification. Consequently, a remote attacker can forge...
[SECURITY] [DSA 4305-1] strongswan security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4305-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez September 24, 2018 https://www.debian.org/security/faq -...
PT-2018-3465
Name of the Vulnerable Software and Affected Versions: strongSwan versions 4.x through 5.x before 5.7.0 Description: The issue is related to the verify emsa pkcs1 signature function in the gmp plugin, which does not correctly verify cryptographic signatures. This can allow a remote attacker to...
Security Bulletin: Multiple vulnerabilities in strongswan affect IBM Flex System Manager (FSM) (CVE-2017-9023, CVE-2017-9022)
Summary Multiple vulnerabilities have been identified in strongswan that is embedded in the FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2017-9023 DESCRIPTION: strongSwan is vulnerable to a denial of service, caused by the improper handling of CHOICE types ...
strongSwan gmp Plugin Denial of Service (CVE-2017-11185)
A denial-of-service vulnerability exists in strongSwan. The vulnerability is due to insufficient validation of RSA signature values before their use within the gmp plugin. A remote attacker could exploit this vulnerability by sending a crafted message to the target server...
CVE-2017-11185
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted RSA signature...
strongSwan Denial of Service Vulnerability
strongSwan is an open source IPsec-based VPN solution for Linux maintained by Swiss software developer Andreas Steffen. The solution includes X.509 public key certificates, secure storage of private keys, smart cards and other authentication mechanisms. gmp plugin is one of the plug-ins. The gmp...
Debian DLA-1059-1 : strongswan security update
It was discovered that there was a denial of service vulnerability in the Strongswan Virtual Private Network VPN software. Specific RSA signatures passed to the gmp plugin for verification could cause a NULL pointer dereference. Potential triggers are signatures in certificates, but also signatur...
DEBIAN-CVE-2017-11185
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted RSA signature...
CVE-2017-11185
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted RSA signature...
CVE-2017-11185
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted RSA signature...
ALPINE-CVE-2017-11185
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted RSA signature...
Null pointer dereference
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted RSA signature...
CVE-2017-11185
CVE-2017-11185 affects strongSwan’s gmp plugin prior to version 5.6.0. An attacker can send specially crafted RSA signatures to trigger a NULL pointer dereference, causing the strongSwan daemon to crash (DoS). The available connected sources confirm the vulnerability is due to insufficient valida...
