Openswan IKEv2 Payloads Incomplete Fix Remote Denial Of Service Vulnerability

Bugtraq ID:	65629
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2014-2037
Remote:	Yes
Local:	No
Published:	Feb 18 2014 12:00AM
Updated:	Nov 25 2014 12:55AM
Credit:	Paul Wouters
Vulnerable:	Openswan Openswan 2.6.37 Openswan Openswan 2.6.22 Openswan Openswan 2.6.21 Openswan Openswan 2.6.20 Openswan Openswan 2.6.16 Openswan Openswan 2.6.36 Openswan Openswan 2.6.35 Openswan Openswan 2.6.33 Openswan Openswan 2.6.29 Openswan Openswan 2.6.28 Openswan Openswan 2.6.27 Openswan Openswan 2.6.26 Openswan Openswan 2.6.25 Gentoo Linux
Not Vulnerable:

Openswan IKEv2 Payloads Incomplete Fix Remote Denial Of Service Vulnerability

Openswan is prone to a remote denial-of-service vulnerability.

An attacker may exploit this issue to restart the application, resulting in a denial-of-service condition to legitimate users.

Openswan 2.6.40 and prior are vulnerable.

Note: This issue exists due to an incomplete fix for CVE-2013-6466 (identified in BID 65155 - Openswan IKEv2 payloads Remote Denial Of Service Vulnerability).

Openswan IKEv2 Payloads Incomplete Fix Remote Denial Of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Openswan IKEv2 Payloads Incomplete Fix Remote Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Openswan IKEv2 Payloads Incomplete Fix Remote Denial Of Service Vulnerability

References: