Rapid7 Vulnerability & Exploit Database

ELSA-2009-0402 Important: Enterprise Linux openswan security update

Free InsightVM Trial No credit card necessary

Watch Demo See how it all works

Back to Search

ELSA-2009-0402 Important: Enterprise Linux openswan security update

Severity

CVSS

(AV:N/AC:L/Au:N/C:N/I:N/A:P)

Published

09/24/2008

Created

07/25/2018

Added

12/20/2011

Modified

07/04/2017

Description

The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.

Solution(s)

oracle-linux-upgrade-openswan
oracle-linux-upgrade-openswan-doc

References

https://attackerkb.com/topics/cve-2008-4190
31243
34296
CVE - 2008-4190
CVE - 2009-0790
DSA-1759
DSA-1760
OVAL10078
OVAL11171
RHSA-2009:0402
http://oss.oracle.com/pipermail/el-errata/2009-March/000942.html
45250
49523

Advanced vulnerability management analytics and reporting.

Key Features

Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;