Description
strongSwan 4.2.6 and earlier allows remote attackers to cause a denial of service (daemon crash) via an IKE_SA_INIT message with a large number of NULL values in a Key Exchange payload, which triggers a NULL pointer dereference for the return value of the mpz_export function in the GNU Multiprecision Library (GMP).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | strongswan | 4.2.4-5 | — |
| Debian 13 | strongswan | 4.2.4-5 | — |
| Debian 12 | strongswan | 4.2.4-5 | — |
References
- ADV-2008-2660 vdb-entry
- 1020903 vdb-entry
- 31291 vdb-entry
- http://labs.mudynamics.com/advisories/MU-200809-01.txt
- 31963 third-party-advisory
- http://download.strongswan.org/CHANGES4.txt