gentoo-overlay/metadata/glsa/glsa-200406-20.xml

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="200406-20">
  <title>FreeS/WAN, Openswan, strongSwan: Vulnerabilities in certificate handling</title>
  <synopsis>
    FreeS/WAN, Openswan, strongSwan and Super-FreeS/WAN contain two bugs when
    authenticating PKCS#7 certificates. This could allow an attacker to
    authenticate with a fake certificate.
  </synopsis>
  <product type="ebuild">Openswan</product>
  <announced>2004-06-25</announced>
  <revised count="02">2006-05-22</revised>
  <access>remote</access>
  <affected>
    <package name="net-misc/freeswan" auto="yes" arch="*">
      <unaffected range="ge">2.04-r1</unaffected>
      <unaffected range="eq">1.99-r1</unaffected>
      <vulnerable range="lt">2.04-r1</vulnerable>
    </package>
    <package name="net-misc/openswan" auto="yes" arch="*">
      <unaffected range="ge">2.1.4</unaffected>
      <unaffected range="eq">1.0.6_rc1</unaffected>
      <vulnerable range="lt">2.1.4</vulnerable>
    </package>
    <package name="net-misc/strongswan" auto="yes" arch="*">
      <unaffected range="ge">2.1.3</unaffected>
      <vulnerable range="lt">2.1.3</vulnerable>
    </package>
    <package name="net-misc/super-freeswan" auto="yes" arch="*">
      <vulnerable range="le">1.99.7.3</vulnerable>
    </package>
  </affected>
  <background>
    <p>
    FreeS/WAN, Openswan, strongSwan and Super-FreeS/WAN are Open Source
    implementations of IPsec for the Linux operating system. They are all
    based on the discontinued FreeS/WAN project.
    </p>
  </background>
  <description>
    <p>
    All these IPsec implementations have several bugs in the
    verify_x509cert() function, which performs certificate validation, that
    make them vulnerable to malicious PKCS#7 wrapped objects.
    </p>
  </description>
  <impact type="normal">
    <p>
    With a carefully crafted certificate payload an attacker can
    successfully authenticate against FreeS/WAN, Openswan, strongSwan or
    Super-FreeS/WAN, or make the daemon go into an endless loop.
    </p>
  </impact>
  <workaround>
    <p>
    There is no known workaround at this time. All users are encouraged to
    upgrade to the latest available version.
    </p>
  </workaround>
  <resolution>
    <p>
    All FreeS/WAN 1.9x users should upgrade to the latest stable version:
    </p>
    <code>
    # emerge sync
    
    # emerge -pv "=net-misc/freeswan-1.99-r1"
    # emerge "=net-misc/freeswan-1.99-r1"</code>
    <p>
    All FreeS/WAN 2.x users should upgrade to the latest stable version:
    </p>
    <code>
    # emerge sync
    
    # emerge -pv "&gt;=net-misc/freeswan-2.04-r1"
    # emerge "&gt;=net-misc/freeswan-2.04-r1"</code>
    <p>
    All Openswan 1.x users should upgrade to the latest stable version:
    </p>
    <code>
    # emerge sync
    
    # emerge -pv "=net-misc/openswan-1.0.6_rc1"
    # emerge "=net-misc/openswan-1.0.6_rc1"</code>
    <p>
    All Openswan 2.x users should upgrade to the latest stable version:
    </p>
    <code>
    # emerge sync
    
    # emerge -pv "&gt;=net-misc/openswan-2.1.4"
    # emerge "&gt;=net-misc/openswan-2.1.4"</code>
    <p>
    All strongSwan users should upgrade to the latest stable version:
    </p>
    <code>
    # emerge sync
    
    # emerge -pv "&gt;=net-misc/strongswan-2.1.3"
    # emerge "&gt;=net-misc/strongswan-2.1.3"</code>
    <p>
    All Super-FreeS/WAN users should migrate to the latest stable version
    of Openswan. Note that Portage will force a move for Super-FreeS/WAN
    users to Openswan.
    </p>
    <code>
    # emerge sync
    
    # emerge -pv "=net-misc/openswan-1.0.6_rc1"
    # emerge "=net-misc/openswan-1.0.6_rc1"</code>
  </resolution>
  <references>
    <uri link="https://lists.openswan.org/pipermail/dev/2004-June/000370.html">Openswan/strongSwan Authentication Bug</uri>
    <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0590">CVE-2004-0590</uri>
  </references>
  <metadata tag="submitter">
    jaervosz
  </metadata>
</glsa>