CVE-2015-8023
Summary
| CVE | CVE-2015-8023 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2015-11-18 16:59:00 UTC |
| Updated | 2023-11-07 02:28:00 UTC |
| Description | The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message. |
Risk And Classification
Problem Types: CWE-264 | CWE-20
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 15.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 15.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 14.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 15.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 15.10 | All | All | All |
| Application | Strongswan | Strongswan | 4.2.12 | All | All | All |
| Application | Strongswan | Strongswan | 4.2.13 | All | All | All |
| Application | Strongswan | Strongswan | 4.2.14 | All | All | All |
| Application | Strongswan | Strongswan | 4.2.15 | All | All | All |
| Application | Strongswan | Strongswan | 4.2.16 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.0 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.1 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.2 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.3 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.4 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.5 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.6 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.7 | All | All | All |
| Application | Strongswan | Strongswan | 4.4.0 | All | All | All |
| Application | Strongswan | Strongswan | 4.4.1 | All | All | All |
| Application | Strongswan | Strongswan | 4.5.0 | All | All | All |
| Application | Strongswan | Strongswan | 4.5.1 | All | All | All |
| Application | Strongswan | Strongswan | 4.5.2 | All | All | All |
| Application | Strongswan | Strongswan | 4.5.3 | All | All | All |
| Application | Strongswan | Strongswan | 4.6.0 | All | All | All |
| Application | Strongswan | Strongswan | 4.6.1 | All | All | All |
| Application | Strongswan | Strongswan | 4.6.2 | All | All | All |
| Application | Strongswan | Strongswan | 4.6.3 | All | All | All |
| Application | Strongswan | Strongswan | 4.6.4 | All | All | All |
| Application | Strongswan | Strongswan | 5.0.0 | All | All | All |
| Application | Strongswan | Strongswan | 5.0.1 | All | All | All |
| Application | Strongswan | Strongswan | 5.0.2 | All | All | All |
| Application | Strongswan | Strongswan | 5.0.3 | All | All | All |
| Application | Strongswan | Strongswan | 5.0.4 | All | All | All |
| Application | Strongswan | Strongswan | 5.1.0 | All | All | All |
| Application | Strongswan | Strongswan | 5.1.1 | All | All | All |
| Application | Strongswan | Strongswan | 5.1.2 | All | All | All |
| Application | Strongswan | Strongswan | 5.1.3 | All | All | All |
| Application | Strongswan | Strongswan | 5.2.0 | All | All | All |
| Application | Strongswan | Strongswan | 5.2.1 | All | All | All |
| Application | Strongswan | Strongswan | 5.2.2 | All | All | All |
| Application | Strongswan | Strongswan | 5.2.3 | All | All | All |
| Application | Strongswan | Strongswan | 5.3.0 | All | All | All |
| Application | Strongswan | Strongswan | 5.3.1 | All | All | All |
| Application | Strongswan | Strongswan | 5.3.2 | All | All | All |
| Application | Strongswan | Strongswan | 5.3.3 | All | All | All |
| Application | Strongswan | Strongswan | 4.2.12 | All | All | All |
| Application | Strongswan | Strongswan | 4.2.13 | All | All | All |
| Application | Strongswan | Strongswan | 4.2.14 | All | All | All |
| Application | Strongswan | Strongswan | 4.2.15 | All | All | All |
| Application | Strongswan | Strongswan | 4.2.16 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.0 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.1 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.2 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.3 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.4 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.5 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.6 | All | All | All |
| Application | Strongswan | Strongswan | 4.3.7 | All | All | All |
| Application | Strongswan | Strongswan | 4.4.0 | All | All | All |
| Application | Strongswan | Strongswan | 4.4.1 | All | All | All |
| Application | Strongswan | Strongswan | 4.5.0 | All | All | All |
| Application | Strongswan | Strongswan | 4.5.1 | All | All | All |
| Application | Strongswan | Strongswan | 4.5.2 | All | All | All |
| Application | Strongswan | Strongswan | 4.5.3 | All | All | All |
| Application | Strongswan | Strongswan | 4.6.0 | All | All | All |
| Application | Strongswan | Strongswan | 4.6.1 | All | All | All |
| Application | Strongswan | Strongswan | 4.6.2 | All | All | All |
| Application | Strongswan | Strongswan | 4.6.3 | All | All | All |
| Application | Strongswan | Strongswan | 4.6.4 | All | All | All |
| Application | Strongswan | Strongswan | 5.0.0 | All | All | All |
| Application | Strongswan | Strongswan | 5.0.1 | All | All | All |
| Application | Strongswan | Strongswan | 5.0.2 | All | All | All |
| Application | Strongswan | Strongswan | 5.0.3 | All | All | All |
| Application | Strongswan | Strongswan | 5.0.4 | All | All | All |
| Application | Strongswan | Strongswan | 5.1.0 | All | All | All |
| Application | Strongswan | Strongswan | 5.1.1 | All | All | All |
| Application | Strongswan | Strongswan | 5.1.2 | All | All | All |
| Application | Strongswan | Strongswan | 5.1.3 | All | All | All |
| Application | Strongswan | Strongswan | 5.2.0 | All | All | All |
| Application | Strongswan | Strongswan | 5.2.1 | All | All | All |
| Application | Strongswan | Strongswan | 5.2.2 | All | All | All |
| Application | Strongswan | Strongswan | 5.2.3 | All | All | All |
| Application | Strongswan | Strongswan | 5.3.0 | All | All | All |
| Application | Strongswan | Strongswan | 5.3.1 | All | All | All |
| Application | Strongswan | Strongswan | 5.3.2 | All | All | All |
| Application | Strongswan | Strongswan | 5.3.3 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| openSUSE-SU-2015:2103-1: moderate: Security update for strongswan | SUSE | lists.opensuse.org | |
| [security-announce] SUSE-SU-2015:2183-2: important: Security update for | SUSE | lists.opensuse.org | |
| strongSwan - strongSwan Vulnerability (CVE-2015-8023) | www.strongswan.org | ||
| USN-2811-1: strongSwan vulnerability | Ubuntu | UBUNTU | www.ubuntu.com | |
| Debian -- Security Information -- DSA-3398-1 strongswan | DEBIAN | www.debian.org | |
| strongSwan - strongSwan Vulnerability (CVE-2015-8023) | CONFIRM | www.strongswan.org | |
| strongSwan CVE-2015-8023 Authentication Bypass Vulnerability | BID | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.