strongSwan OpenSSL Plugin CVE-2013-2944 Authentication Bypass Vulnerability

Bugtraq ID:	59580
Class:	Access Validation Error
CVE:	CVE-2013-2944
Remote:	Yes
Local:	No
Published:	Apr 30 2013 12:00AM
Updated:	Sep 03 2013 12:09AM
Credit:	Tobias Brunner
Vulnerable:	strongSwan strongSwan 4.4.1 strongSwan strongSwan 4.4 strongSwan strongSwan 4.3.7 strongSwan strongSwan 4.3.6 strongSwan strongSwan 4.3.5 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

strongSwan OpenSSL Plugin CVE-2013-2944 Authentication Bypass Vulnerability

strongSwan is prone to a remote authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions on the affected computer. This may aid in further attacks.

strongSwan 4.3.5 through 5.0.3 are vulnerable; other versions may also be affected.

strongSwan OpenSSL Plugin CVE-2013-2944 Authentication Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

strongSwan OpenSSL Plugin CVE-2013-2944 Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

strongSwan OpenSSL Plugin CVE-2013-2944 Authentication Bypass Vulnerability

References:

• strongSwan Homepage (strongSwan)