Strongswan : Integer Overflow When Replacing Certificates in Cache
Vulnerability details
A vulnerability in stronsgwan can lead to a DoS of the IPSec functionality or unlikely to a RCE.
Impacted products
Revisions
| Version |
Date |
Description |
| v1 |
12/08/2021 |
Initial release |
Stormshield Network Security |
CVSS v3.1 Overall Score: 6.5 
|
Analysis
|
Impacted version
|
|
An attacker who makes several requests to connect to an IPSec tunnel with a valid certificate by modifying the signatureAlgorithm field will request the cache to store the different variants of the same certificate. As the cache management is poorly managed, a bad index calculation can lead to access to unauthorized memory, therefore a SEGFAULT or very improbably an RCE although an attacker does not have direct control over the dereferenced memory.
|
- SNS 2.1.0 to 2.7.8
- SNS 3.0.0 to 3.7.22
- SNS 3.8.0 to 3.11.10
- SNS 4.0.0 to 4.2.6
|
Workaround solution
|
Solution
|
|
There is no workaround solution.
|
The vulnerability is fixed in versions:
- 2.7.9
- 3.7.23
- 3.11.11
- 4.2.7
|
| Attack Vector |
Attack Complexity |
Privileges Required |
User Interaction |
Scope |
Confidentiality Impact |
Integrity Impact |
Availability impact |
| Network |
High |
Low |
None |
Unchanged |
High |
High |
High |
| Exploit Code Maturity |
Remediation Level |
Report Confidence |
| Unproven that exploit exists |
Official fix |
Confirmed |
| Confidentiality Requirement |
Integrity Requirement |
Availability Requirement |
| High |
High |
High |
