Buffer overflow in Strongswan
CVE-2013-6075
The compare_dn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows (1) remote attackers to cause a denial of service (out-of-bounds read, NULL pointer dereference, and daemon crash) or (2) remote authenticated users to impersonate arbitrary users and bypass access restrictions via a crafted ID_DER_ASN1_DN ID, related to an "insufficient length check" during identity comparison.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.024 (83.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 83.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.024 · newest: 0.024 · change: 0.000
Affected products
- Strongswan — versions 4.3.3, 4.3.4, 4.3.5
Weakness classification (CWE)
References
- www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-(… (Patch, Vendor Advisory)
- download.strongswan.org/security/CVE-2013-6075/strongswan-4.3.3-5.1.0_id_dn_mat… (Patch)
- www.debian.org/security/2012/dsa-2789 (vendor-advisory)