Permalink
Browse files

Add a list and copy of all CVE's related to openswan.

  • Loading branch information...
letoams committed Oct 7, 2010
1 parent 7a93474 commit f7dff4e8f55ebb4a55ed296bd5acbc907673d307
Showing with 266 additions and 0 deletions.
  1. +84 −0 security/CVE-2009-0790.txt
  2. +35 −0 security/CVE-2009-2185.txt
  3. +70 −0 security/CVE-2010-3302.txt
  4. +70 −0 security/CVE-2010-3308.txt
  5. +7 −0 security/README
View
@@ -0,0 +1,84 @@
==========================================================================
Openswan & Strongswan Security Notification March 30, 2009
Remote DoS Vulnerability in Openswan & Strongswan IPsec
CVE-2009-0790
==========================================================================
A vulnerability in the Dead Peer Detection (RFC-3706) code was found by
Gerd v. Egidy <gerd.von.egidy@intra2net.com> of Intra2net AG affecting
all Openswan and all Strongswan releases.
A malicious (or expired ISAKMP) R_U_THERE or R_U_THERE_ACK Dead Peer
Detection packet can cause the pluto IKE daemon to crash and restart. No
authentication or encryption is required to trigger this bug. One spoofed
UDP packet can cause the pluto IKE daemon to restart and be unresponsive
for a few seconds while restarting.
A patch was created by Paul Wouters <paul@xelerance.com> for Openswan and
Strongswan.
This bug affects the following software releases:
Current branches:
Openswan-2.6.20 and earlier
Strongswan-4.2.13 and earlier
Maintenance mode branches:
Openswan-2.4.13 and earlier
Strongswan-2.8.8 and earlier
End of Life branches:
Superfreeswan-1.9x
Openswan-1.x
Openswan-2.0.x - 2.3.1
Openswan-2.5.x
Everyone is strongly encouraged to upgrade to these minimum versions:
openswan-2.6.21
strongswan-4.2.14
openswan-2.4.14
strongswan-2.8.9
If you cannot upgrade to a new version, please apply the appropriate
patch as listed at http://www.openswan.org/CVE-2009-0790/
Dead Peer Detection is an IPsec IKE Notification message. It uses
an ICOOKIE/RCOOKIE mechanism to match an incoming packet to a know
Security Association (ISAKMP). Unlike most Notification messages, DPD
notifications have no phase2 state association. Incorrect handling of
this exception can cause a NULL pointer dereference on a non-existing
state object 'st'. This bug is triggered in the case where one end has
expired an ISAKMP state, but the other end still uses the old state
to send a DPD Notification.
Since this state-lookup is performed before any encryption or
decryption takes place, as we need to find the proper ISAKMP to locate
the cryptogrpahic key material used for decryption, this bug can be
triggered without going through a phase1 (ISAKMP) negotiation.
When such a packet is received, the pluto daemon crashes and restarts.
Locations for downloading patches and source code:
http://www.openswan.org/ http://www.strongswan.org/
ftp://ftp.openswan.org/openswan/ http://download1.strongswan.org/
ftp://ftp.openswan.fi/pub/openswan/ http://download2.strongswan.org/
Paul Wouters <paul@xelerance.com>
GPG key: 0xB5CC27E1
==========================================================================
These patches are included in openswan-2.4.14 and openswan-2.6.21 and above.
openswan-2.x.x-dpd_null_state.patch should be applied to:
- openswan-2.4.x < 2.4.14 (Maintenance mode)
- openswan-2.5.x (EOL)
- openswan-2.0.0 through openswan-2.3.1 (EOL)
- openswan-1.x (EOL)
- superfreeswan (EOL)
openswan-2.6.x-dpd_null_state.patch should be applied to:
- openswan-2.6.x < 2.6.21
View
@@ -0,0 +1,35 @@
[ Note: openswan 2.6.22 and 2.4.15 contain these patches and were released
on June 22 and June 25 2009 ]
Date: Mon, 22 Jun 2009 12:34:51 -0400 (EDT)
From: Paul Wouters <paul@xelerance.com>
To: vendor-sec@lst.de
cc: Andreas Steffen <andreas.steffen@strongswan.org>
Subject: ASN.1 vulnerabilities in strongswan / openswan
Thanks to Mr. Steffen for his irrresponsible behaviour, the openswan
project is currently dealing with two 0-day bugs as reported here:
http://www.vupen.com/english/advisories/2009/1639
We are currently looking into these bugs. We plan to release openswan
2.6.22 later today. If you wish to get only the bugfixes instead of a
new release, please monitor the git repository at http://git.openswan.org/
over the next couple of hours.
After doing all the work to co-ordinate with the strongswan project on
the previous CVE (and not receiving any credit for it whatsoever, despite
giving him the patches on a silver platter), I had expected to at least
receive a courtesy warning a few days before publishing such remotely
exploitable vulnerabilities. Mr Steffen knows his ASN.1 code in the pluto
daemon from strongswan comes from his code in the openswan version.
I kindly request people on this list to notify me personally in the future
if any strongswan undisclosed vulnerabilities are posted to this list that
involve strongswan's IKEv1 pluto daemon from the openswan project, as Mr.
Steffen obviously cares more about his project, then the security of the
community at large.
Paul
View
@@ -0,0 +1,70 @@
CVE-2010-3302: Openswan cisco DNS option handling vulnerability
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2010-3302
See also: CVE-2010-3308 Openswan cisco banner option handling vulnerability
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2010-3308
Security Alert:
This alert (and any possible updates) is available at the following URL:
http://www.openswan.org/download/CVE-2010-3302/
The Openswan project has discovered a vulnerability in the XAUTH
Cisco handling code that could be exploited if openswan connects to a
trusted gateway that has been compromised.
Vulnerable versions: openswan 2.6.25 up to and including openswan 2.6.28
Fixed version : openswan 2.6.29 and above
Vulnerability information:
In very specific circumstances, a buffer overflow and arbitrary shell
commands could be sent to a vulnerable openswan client.
These vulnerabilities can only be triggered when openswan is configured to
connect to a malicious Cisco compatible gateway using XAUTH. It requires
openswan to be configured with *xauthclient=yes and remote_peer_type=cisco,
and requires successful phase1 IKE negotiation. This can only happen to a
vulnerable Openswan client when connecting to a trusted and authenticated
gateway using XAUTH.
An Openswan server receiving VPN connections is not affected by this flaw.
Vulnerability Details:
The fields cisco_dns_info and cisco_domain_info were declared as a fixed
length buffer. If enough DNS payloads are sent in one packet, the buffer will
overflow. Additionally, these fields were copied into fmt_common_shell_out()
without being sanitized to make it safe against exploitable characters,
such as single quotes('). This was introduced in git commit id 3115ee29,
on March 19, 2010 and first released in openswan 2.6.25. The vulnerability
is fixed in openswan 2.6.29.
Patch:
For those unable to upgrade to the latest openswan 2.6.29 release, a patch
addressing CVE-2010-3302 (and CVE-2010-3308) can be found at:
http://www.openswan.org/download/CVE-2010-330x/
Full release:
The latest openswan release which fixes all known issues can be found at:
http://www.openswan.org/download/openswan-2.6.29.tar.gz
http://www.openswan.org/download/openswan-2.6.29.tar.gz.asc (GPG signature)
Credit:
These vulnerabilities were found by D. Hugh Redelmeier <hugh@mimosa.com>
and Paul Wouters <paul@xelerance.com>
About openswan (http://www.openswan.org/):
Openswan is a free implementation of Internet Protocol Security (IPsec)
and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide
both authentication and encryption services. These services allow you to
build secure tunnels through untrusted networks. Everything passing through
the untrusted network is encrypted by the IPsec gateway machine, and
decrypted by the gateway at the other end of the tunnel. The resulting
tunnel is a virtual private network (VPN).
About Xelerance (http://www.xelerance.com/):
Xelerance is the custodian of the openswan IPsec software and the L2TP
server xl2tpd. These are used in combination to provide Enterprise VPN
solutions. Headquartered in Ottawa, the high-tech capital of Canada,
Xelerance provides products and services to secure the internet. Its
products include DNSX Secure Signer, which won the Best Security Hardware
award at FOSE 2010, and DNSX Secure Resolver.
View
@@ -0,0 +1,70 @@
CVE-2010-3308 Openswan cisco banner option handling vulnerability
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2010-3308
See also: CVE-2010-3302: Openswan cisco DNS option handling vulnerability
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2010-3302
Security Alert:
This alert (and any possible updates) is available at the following URL:
http://www.openswan.org/download/CVE-2010-3302/
The Openswan project has discovered two vulnerabilities in the XAUTH
Cisco handling code that could be exploited if openswan connects to a
trusted gateway that has been compromised.
Vulnerable versions: openswan 2.6.26 up to and including openswan 2.6.28
Fixed version : openswan 2.6.29 and above
Vulnerability information:
In very specific circumstances, a buffer overflow and arbitrary shell
commands could be sent to a vulnerable openswan client.
These vulnerabilities can only be triggered when openswan is configured to
connect to a malicious Cisco compatible gateway using XAUTH. It requires
openswan to be configured with *xauthclient=yes and remote_peer_type=cisco,
and requires successful phase1 IKE negotiation. This can only happen to a
vulnerable Openswan client when connecting to a trusted and authenticated
gateway using XAUTH.
An Openswan server receiving VPN connections is not affected by this flaw.
Vulnerability Details:
The field cisco_banner (later renamed to server_banner) were declared as a
fixed length buffer. If a banner is sent with more then 500 characters,
the buffer will overflow. Additionally, the banner was copied
into fmt_common_shell_out() without being sanitized to make it safe
against exploitable characters, such as single quotes('). This was
introduced in git commit id 3615e17463a, on May 19, 2010 and first
released in openswan 2.6.26.
Patch:
For those unable to upgrade to the latest openswan 2.6.29 release, a patch
addressing CVE-2010-3308 and CVE-2010-3302 can be found at:
http://www.openswan.org/download/CVE-2010-3308/
Full release:
The latest openswan release which fixes all known issues can be found at:
http://www.openswan.org/download/openswan-2.6.29.tar.gz
http://www.openswan.org/download/openswan-2.6.29.tar.gz.asc (GPG signature)
Credit:
These vulnerabilities were found by D. Hugh Redelmeier <hugh@mimosa.com>
and Paul Wouters <paul@xelerance.com>
About openswan (http://www.openswan.org/):
Openswan is a free implementation of Internet Protocol Security (IPsec)
and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide
both authentication and encryption services. These services allow you to
build secure tunnels through untrusted networks. Everything passing through
the untrusted network is encrypted by the IPsec gateway machine, and
decrypted by the gateway at the other end of the tunnel. The resulting
tunnel is a virtual private network (VPN).
About Xelerance (http://www.xelerance.com/):
Xelerance is the custodian of the openswan IPsec software and the L2TP
server xl2tpd. These are used in combination to provide Enterprise VPN
solutions. Headquartered in Ottawa, the high-tech capital of Canada,
Xelerance provides products and services to secure the internet. Its
products include DNSX Secure Signer, which won the Best Security Hardware
award at FOSE 2010, and DNSX Secure Resolver.
View
@@ -0,0 +1,7 @@
Below follows all openswan related CVE's
Sep 27 2010: Security release for CVE-2010-3308 (CVE-2010-3753 is duplicate)
Sep 27 2010: Security release for CVE-2010-3302 (CVE-2010-3752 is duplicate)
Mar 30 2009: Security release for CVE-2009-0790
Jun 24 2009: Security release for CVE-2009-2185

0 comments on commit f7dff4e

Please sign in to comment.