drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Fehlerhafte Authentikation von Zertifikaten in freeswan, openswan und strongswan
Name: |
Fehlerhafte Authentikation von Zertifikaten in freeswan, openswan und strongswan
|
|
ID: |
200406-20 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Sa, 26. Juni 2004, 13:00 |
|
Referenzen: |
http://lists.openswan.org/pipermail/dev/2004-June/000370.html |
|
Applikationen: |
strongSwan |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200406-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal Title: FreeS/WAN, Openswan, strongSwan: Vulnerabilities in certificate handling Date: June 25, 2004 ID: 200406-20
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
FreeS/WAN, Openswan, strongSwan and Super-FreeS/WAN contain two bugs when authenticating PKCS#7 certificates. This could allow an attacker to authenticate with a fake certificate.
Background ==========
FreeS/WAN, Openswan, strongSwan and Super-FreeS/WAN are Open Source implementations of IPsec for the Linux operating system. They are all based on the discontinued FreeS/WAN project.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/freeswan < 2.04-r1 >= 2.04-r1 == 1.99-r1 2 net-misc/openswan < 2.1.4 >= 2.1.4 == 1.0.6_rc1 3 net-misc/strongswan < 2.1.3 >= 2.1.3 4 net-misc/super-freeswan <= 1.99.7.3 Vulnerable!
Description ===========
All these IPsec implementations have several bugs in the verify_x509cert() function, which performs certificate validation, that make them vulnerable to malicious PKCS#7 wrapped objects.
Impact ======
With a carefully crafted certificate payload an attacker can successfully authenticate against FreeS/WAN, Openswan, strongSwan or Super-FreeS/WAN, or make the daemon go into an endless loop.
Workaround ==========
There is no known workaround at this time. All users are encouraged to upgrade to the latest available version.
Resolution ==========
All FreeS/WAN 1.9x users should upgrade to the latest stable version:
# emerge sync
# emerge -pv "=net-misc/freeswan-1.99-r1" # emerge "=net-misc/freeswan-1.99-r1"
All FreeS/WAN 2.x users should upgrade to the latest stable version:
# emerge sync
# emerge -pv ">=net-misc/freeswan-2.04-r1" # emerge ">=net-misc/freeswan-2.04-r1"
All Openswan 1.x users should upgrade to the latest stable version:
# emerge sync
# emerge -pv "=net-misc/openswan-1.0.6_rc1" # emerge "=net-misc/openswan-1.0.6_rc1"
All Openswan 2.x users should upgrade to the latest stable version:
# emerge sync
# emerge -pv ">=net-misc/openswan-2.1.4" # emerge ">=net-misc/openswan-2.1.4"
All strongSwan users should upgrade to the latest stable version:
# emerge sync
# emerge -pv ">=net-misc/strongswan-2.1.3" # emerge ">=net-misc/strongswan-2.1.3"
All Super-FreeS/WAN users should migrate to the latest stable version of Openswan. Note that Portage will force a move for Super-FreeS/WAN users to Openswan.
# emerge sync
# emerge -pv "=net-misc/openswan-1.0.6_rc1" # emerge "=net-misc/openswan-1.0.6_rc1"
References ==========
[ 1 ] Openswan/strongSwan Authentication Bug http://lists.openswan.org/pipermail/dev/2004-June/000370.html
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200406-20.xml
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.
License =======
Copyright 2004 Gentoo Technologies, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFA3I/4vcL1obalX08RAkFTAJ9G6U5OAw9poy1YiHAS6sKEf+KSFQCfQJx+ kgh6zpXu/VV8W77ZrkawRgA= =m9Rn -----END PGP SIGNATURE-----
|
|
|
|