Libreswan 'IKEv2' Payloads Remote Denial of Service Vulnerability

Bugtraq ID:	64987
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-6467
Remote:	Yes
Local:	No
Published:	Jan 15 2014 12:00AM
Updated:	Apr 13 2015 09:58PM
Credit:	Iustina Melinte
Vulnerable:	Libreswan Libreswan 3.7 Libreswan Libreswan 3.6 Libreswan Libreswan 3.4 Libreswan Libreswan 3.3
Not Vulnerable:	Libreswan Libreswan 3.8

Libreswan 'IKEv2' Payloads Remote Denial of Service Vulnerability

Libreswan is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the affected application to restart, denying service to legitimate users.

Versions prior to Libreswan 3.8 are vulnerable.

Libreswan 'IKEv2' Payloads Remote Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Libreswan 'IKEv2' Payloads Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Libreswan 'IKEv2' Payloads Remote Denial of Service Vulnerability

References:

• CVE-2013-6466 Openswan IKEv2 payloads denial of service (Libreswan)
  
• Libreswan changelogs (Libreswan)
  
• Openswan Homepage (Openswan)