What is CVE-2015-3204?

CVE-2015-3204 is a vulnerability in Libreswan, classified under Improper Input Validation. Published 2015-07-01.

Is CVE-2015-3204 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Improper input validation in Libreswan

CVE-2015-3204

libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bits set in the IPSEC DOI value or (2) the next payload value set to ISAKMP_NEXT_SAK.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.026 (83.7th percentile) — read the EPSS interpretation.

Affected products

Libreswan — versions 3.9, 3.10, 3.11
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

Public proof-of-concept exploits

Live-Hack-CVE/CVE-2015-3204

References

secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (vendor-advisory, x_refsource_GENTOO)
secalert@redhat.com (vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2015-3204?: CVE-2015-3204 is a vulnerability in Libreswan, classified under Improper Input Validation. Published 2015-07-01.
Is CVE-2015-3204 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.