[Forgot Password]
Login  Register Subscribe

24128

 
 

131573

 
 

110507

 
 

909

 
 

86504

 
 

136

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2009-0790Date: (C)2009-04-01   (M)2018-06-20


The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : CVSS Score : 5.0
Exploit Score: Exploit Score: 10.0
Impact Score: Impact Score: 2.9
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: Access Vector: NETWORK
Attack Complexity: Access Complexity: LOW
Privileges Required: Authentication: NONE
User Interaction: Confidentiality: NONE
Scope: Integrity: NONE
Confidentiality: Availability: PARTIAL
Integrity:  
Availability:  
  
Reference:
SECTRACK-1021949
SECTRACK-1021950
http://www.securityfocus.com/archive/1/archive/1/502270/100/0/threaded
BID-34296
SECUNIA-34472
SECUNIA-34483
SECUNIA-34494
SECUNIA-34546
ADV-2009-0886
DSA-1759
DSA-1760
RHSA-2009:0402
SUSE-SR:2009:009
http://download.strongswan.org/CHANGES4.txt
http://www.openswan.org/CVE-2009-0790/CVE-2009-0790.txt
openswan-strongswan-dpd-dos(49523)

CPE    59
cpe:/a:openswan:openswan:2.6.19
cpe:/a:openswan:openswan:2.6.17
cpe:/a:openswan:openswan:2.6.18
cpe:/a:openswan:openswan:2.6.20
...
CWE    1
CWE-20
OVAL    9
oval:org.secpod.oval:def:600315
oval:org.secpod.oval:def:600310
oval:org.mitre.oval:def:8005
oval:org.mitre.oval:def:7907
...

© SecPod Technologies