Vulnerability in Xelerance Openswan

CVE-2011-3380

Openswan 2.6.29 through 2.6.35 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto IKE daemon crash) via an ISAKMP message with an invalid KEY_LENGTH attribute, which is not properly handled by the error handling function.

EPSS: 0.023 (81.3th percentile) — read the EPSS interpretation.

Affected products

Xelerance Openswan — versions 2.6.29, 2.6.30, 2.6.31
N/a — versions n/a

References

secalert@redhat.com (x_refsource_CONFIRM, Patch)
secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)