CVE-2009-1632

CWE-399CWE-401 — Memory Leak6 documents6 sources
Severity
5.0MEDIUM
EPSS
4.7%
top 10.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Ipsec-tools Ipsec-tools
Timeline
PublishedMay 14
Latest updateMay 2

Description

Multiple memory leaks in Ipsec-tools before 0.7.2 allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) signature verification during user authentication with X.509 certificates, related to the eay_check_x509sign function in src/racoon/crypto_openssl.c; and (2) the NAT-Traversal (aka NAT-T) keepalive implementation, related to src/racoon/nattraversal.c.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

Patches

Patch: sourceforge.net ↗Patch: sourceforge.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-r3x2-g3qw-mvq3: Multiple memory leaks in Ipsec-tools before 0↗2022-05-02
▶
CVEList
CVE-2009-1632: Multiple memory leaks in Ipsec-tools before 0↗2009-05-14
▶

📋Vendor Advisories

2
Ubuntu
ipsec-tools vulnerabilities↗2009-06-09
▶
Red Hat
ipsec-tools: multiple memory leaks fixed in 0.7.2↗2009-04-22
▶

💬Community

1
Bugzilla
CVE-2009-1632 ipsec-tools: multiple memory leaks fixed in 0.7.2↗2009-05-14
▶