strongSwan CVE-2014-2338 Authentication Bypass Vulnerability

Bugtraq ID:	66815
Class:	Access Validation Error
CVE:	CVE-2014-2338
Remote:	Yes
Local:	No
Published:	Apr 15 2014 12:00AM
Updated:	Nov 03 2015 07:14PM
Credit:	The vendor reported this issue.
Vulnerable:	SuSE SUSE Linux Enterprise Server 10 SP3 LTSS + Linux kernel 2.6.5 strongSwan strongSwan 4.4.1 strongSwan strongSwan 4.4 strongSwan strongSwan 4.3.7 strongSwan strongSwan 4.3.6 strongSwan strongSwan 4.3.5 strongSwan strongSwan 4.3.3 strongSwan strongSwan 4.3.2 strongSwan strongSwan 4.3.1 strongSwan strongSwan 4.3 strongSwan strongSwan 4.2.17 strongSwan strongSwan 4.2.16 strongSwan strongSwan 4.2.15 strongSwan strongSwan 4.2.14 strongSwan strongSwan 4.2.13 strongSwan strongSwan 4.2.7 strongSwan strongSwan 4.2.6 strongSwan strongSwan 4.1 strongSwan strongSwan 4.3.4 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

strongSwan CVE-2014-2338 Authentication Bypass Vulnerability

strongSwan is prone to a remote authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions on the affected computer. This may aid in further attacks.

strongSwan 4.0.7 through 5.1.2 are vulnerable; other versions may also be affected.

strongSwan CVE-2014-2338 Authentication Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

strongSwan CVE-2014-2338 Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.