[Forgot Password]
Login  Register Subscribe

23631

 
 

126941

 
 

98250

 
 

909

 
 

79281

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2009-0790

Date: (C)2009-04-01   (M)2017-11-18 


The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.

CVSS Score: 5.0Access Vector: NETWORK
Exploit Score: 10.0Access Complexity: LOW
Impact Score: 2.9Authentication: NONE
 Confidentiality: NONE
 Integrity: NONE
 Availability: PARTIAL





Reference:
SECTRACK-1021949
SECTRACK-1021950
http://www.securityfocus.com/archive/1/archive/1/502270/100/0/threaded
BID-34296
SECUNIA-34472
SECUNIA-34483
SECUNIA-34494
SECUNIA-34546
ADV-2009-0886
DSA-1759
DSA-1760
RHSA-2009:0402
SUSE-SR:2009:009
http://download.strongswan.org/CHANGES4.txt
http://www.openswan.org/CVE-2009-0790/CVE-2009-0790.txt
openswan-strongswan-dpd-dos(49523)

CPE    59
cpe:/a:strongswan:strongswan:2.8.8
cpe:/a:strongswan:strongswan:2.8.6
cpe:/a:strongswan:strongswan:2.8.7
cpe:/a:strongswan:strongswan:2.8.4
...
CWE    1
CWE-20
OVAL    9
oval:org.secpod.oval:def:1300235
oval:org.secpod.oval:def:202093
oval:org.secpod.oval:def:202003
oval:org.secpod.oval:def:500666
...

© 2013 SecPod Technologies