Libreswan 'programs/pluto/demux.c' Remote Denial of Service Vulnerability

Bugtraq ID:	64528
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-4564
Remote:	Yes
Local:	No
Published:	Dec 18 2013 12:00AM
Updated:	Apr 13 2015 09:38PM
Credit:	Paul Wouters and D. Hugh Redelmeier
Vulnerable:	Libreswan Libreswan 3.6
Not Vulnerable:	Libreswan Libreswan 3.7

Libreswan 'programs/pluto/demux.c' Remote Denial of Service Vulnerability

Libreswan is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the affected application to crash, denying service to legitimate users.

Libreswan 3.6 is vulnerable; other versions may also be affected.

Libreswan 'programs/pluto/demux.c' Remote Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Libreswan 'programs/pluto/demux.c' Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Libreswan 'programs/pluto/demux.c' Remote Denial of Service Vulnerability

References:

• CVE-2013-4564 Libreswan Denial of Service with bogus IKE packet (Libreswan)
  
• Openswan Homepage (Openswan)
  
• SECURITY: Do not inspect or continue on very short packets (Libreswan)