<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> <glsa id="200406-20"> <title>FreeS/WAN, Openswan, strongSwan: Vulnerabilities in certificate handling</title> <synopsis> FreeS/WAN, Openswan, strongSwan and Super-FreeS/WAN contain two bugs when authenticating PKCS#7 certificates. This could allow an attacker to authenticate with a fake certificate. </synopsis> <product type="ebuild">Openswan</product> <announced>2004-06-25</announced> <revised count="02">2006-05-22</revised> <access>remote</access> <affected> <package name="net-misc/freeswan" auto="yes" arch="*"> <unaffected range="ge">2.04-r1</unaffected> <unaffected range="eq">1.99-r1</unaffected> <vulnerable range="lt">2.04-r1</vulnerable> </package> <package name="net-misc/openswan" auto="yes" arch="*"> <unaffected range="ge">2.1.4</unaffected> <unaffected range="eq">1.0.6_rc1</unaffected> <vulnerable range="lt">2.1.4</vulnerable> </package> <package name="net-misc/strongswan" auto="yes" arch="*"> <unaffected range="ge">2.1.3</unaffected> <vulnerable range="lt">2.1.3</vulnerable> </package> <package name="net-misc/super-freeswan" auto="yes" arch="*"> <vulnerable range="le">1.99.7.3</vulnerable> </package> </affected> <background> <p> FreeS/WAN, Openswan, strongSwan and Super-FreeS/WAN are Open Source implementations of IPsec for the Linux operating system. They are all based on the discontinued FreeS/WAN project. </p> </background> <description> <p> All these IPsec implementations have several bugs in the verify_x509cert() function, which performs certificate validation, that make them vulnerable to malicious PKCS#7 wrapped objects. </p> </description> <impact type="normal"> <p> With a carefully crafted certificate payload an attacker can successfully authenticate against FreeS/WAN, Openswan, strongSwan or Super-FreeS/WAN, or make the daemon go into an endless loop. </p> </impact> <workaround> <p> There is no known workaround at this time. All users are encouraged to upgrade to the latest available version. </p> </workaround> <resolution> <p> All FreeS/WAN 1.9x users should upgrade to the latest stable version: </p> <code> # emerge sync # emerge -pv "=net-misc/freeswan-1.99-r1" # emerge "=net-misc/freeswan-1.99-r1"</code> <p> All FreeS/WAN 2.x users should upgrade to the latest stable version: </p> <code> # emerge sync # emerge -pv ">=net-misc/freeswan-2.04-r1" # emerge ">=net-misc/freeswan-2.04-r1"</code> <p> All Openswan 1.x users should upgrade to the latest stable version: </p> <code> # emerge sync # emerge -pv "=net-misc/openswan-1.0.6_rc1" # emerge "=net-misc/openswan-1.0.6_rc1"</code> <p> All Openswan 2.x users should upgrade to the latest stable version: </p> <code> # emerge sync # emerge -pv ">=net-misc/openswan-2.1.4" # emerge ">=net-misc/openswan-2.1.4"</code> <p> All strongSwan users should upgrade to the latest stable version: </p> <code> # emerge sync # emerge -pv ">=net-misc/strongswan-2.1.3" # emerge ">=net-misc/strongswan-2.1.3"</code> <p> All Super-FreeS/WAN users should migrate to the latest stable version of Openswan. Note that Portage will force a move for Super-FreeS/WAN users to Openswan. </p> <code> # emerge sync # emerge -pv "=net-misc/openswan-1.0.6_rc1" # emerge "=net-misc/openswan-1.0.6_rc1"</code> </resolution> <references> <uri link="https://lists.openswan.org/pipermail/dev/2004-June/000370.html">Openswan/strongSwan Authentication Bug</uri> <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0590">CVE-2004-0590</uri> </references> <metadata tag="submitter"> jaervosz </metadata> </glsa>