Strongswan IKEv2 Payloads CVE-2014-9221 Remote Denial Of Service Vulnerability

Bugtraq ID:	71894
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2014-9221
Remote:	Yes
Local:	No
Published:	Jan 05 2015 12:00AM
Updated:	Nov 03 2015 07:16PM
Credit:	Mike Daskalakis
Vulnerable:	Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Strongswan IKEv2 Payloads CVE-2014-9221 Remote Denial Of Service Vulnerability

Strongswan is prone to a remote denial-of-service vulnerability.

An attacker may exploit this issue to crash the application, resulting in a denial-of-service condition to legitimate users.

Strongswan 5.1.2 is vulnerable; other versions may also be affected.

Strongswan IKEv2 Payloads CVE-2014-9221 Remote Denial Of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Strongswan IKEv2 Payloads CVE-2014-9221 Remote Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Strongswan IKEv2 Payloads CVE-2014-9221 Remote Denial Of Service Vulnerability

References:

• Multiple Vulnerabilities (Pexip)
  
• strongswan 5.1.2-0ubuntu3.2 source package in Ubuntu (Ubuntu)
  
• strongSwan Homepage (strongSwan)
  
• Bug 1173064 - strongswan: denial-of-service vulnerability (Red Hat)
  
• Security Bulletin: Vulnerabilities in Strongswan affect Power Hardware Managemen (IBM)