CVE-2009-2185
published 2009-06-25CVE-2009-2185: The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3…
PriorityP423medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
2.37%
82.1th percentile
The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.
Affected
68 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | strongswan | < strongswan 4.2.14-1.2 (bookworm) | strongswan 4.2.14-1.2 (bookworm) |
| debian | strongswan | < strongswan 4.3.2-1.1 (bookworm) | strongswan 4.3.2-1.1 (bookworm) |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7j3p-ffqc-xjpg: The asn1_length function in strongSwan 2
ghsa_unreviewed·2022-05-02·CVSS 5.0
CVE-2009-2661 [MEDIUM] GHSA-7j3p-ffqc-xjpg: The asn1_length function in strongSwan 2
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
GHSA
GHSA-9g49-v8fv-gvm8: The ASN
ghsa_unreviewed·2022-05-02
CVE-2009-2185 [MEDIUM] CWE-20 GHSA-9g49-v8fv-gvm8: The ASN
The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.
OSV
CVE-2009-2661: The asn1_length function in strongSwan 2
osv·2009-08-04·CVSS 5.0
CVE-2009-2661 [MEDIUM] CVE-2009-2661: The asn1_length function in strongSwan 2
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
OSV
CVE-2009-2185: The ASN
osv·2009-06-25·CVSS 5.0
CVE-2009-2185 [MEDIUM] CVE-2009-2185: The ASN
The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.
Red Hat
Openswan ASN.1 parser vulnerability
vendor_redhat·2009-06-22·CVSS 5.0
CVE-2009-2185 [MEDIUM] Openswan ASN.1 parser vulnerability
Openswan ASN.1 parser vulnerability
The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.
Debian
CVE-2009-2185: strongswan - The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/as...
vendor_debian·2009·CVSS 5.0
CVE-2009-2185 [MEDIUM] CVE-2009-2185: strongswan - The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/as...
The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.
Scope: local
bookworm: resolved (fixed in 4.2.14-1.2)
bullseye: resolved (fixed in 4.2.14-1.2)
forky: resolved (fixed in 4.2.14-1.2)
sid: resolved (fixed in 4.2.14-1.2)
trixie: resolved (fixed in 4.2.14-1.2)
Debian
CVE-2009-2661: strongswan - The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and...
vendor_debian·2009·CVSS 5.0
CVE-2009-2661 [MEDIUM] CVE-2009-2661: strongswan - The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and...
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
Scope: local
bookworm: resolved (fixed in 4.3.2-1.1)
bullseye: resolved (fixed in 4.3.2-1.1)
forky: resolved (fixed in 4.3.2-1.1)
sid: resolved (fixed in 4.3.2-1.1)
trixie: resolved (fixed in 4.3.2-1.1)
No detection rules found.
No public exploits indexed.
http://download.strongswan.org/CHANGES2.txthttp://download.strongswan.org/CHANGES4.txthttp://download.strongswan.org/CHANGES42.txthttp://secunia.com/advisories/35522http://secunia.com/advisories/35698http://secunia.com/advisories/35740http://secunia.com/advisories/35804http://secunia.com/advisories/36922http://secunia.com/advisories/36950http://secunia.com/advisories/37504http://up2date.astaro.com/2009/07/up2date_7404_released.htmlhttp://www.debian.org/security/2009/dsa-1898http://www.debian.org/security/2009/dsa-1899http://www.ingate.com/Relnote.php?ver=481http://www.redhat.com/support/errata/RHSA-2009-1138.htmlhttp://www.securityfocus.com/bid/35452http://www.securitytracker.com/id?1022428http://www.vupen.com/english/advisories/2009/1639http://www.vupen.com/english/advisories/2009/1706http://www.vupen.com/english/advisories/2009/1829http://www.vupen.com/english/advisories/2009/3354https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11079https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00264.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-July/msg00337.htmlhttp://download.strongswan.org/CHANGES2.txthttp://download.strongswan.org/CHANGES4.txthttp://download.strongswan.org/CHANGES42.txthttp://secunia.com/advisories/35522http://secunia.com/advisories/35698http://secunia.com/advisories/35740http://secunia.com/advisories/35804http://secunia.com/advisories/36922http://secunia.com/advisories/36950http://secunia.com/advisories/37504http://up2date.astaro.com/2009/07/up2date_7404_released.htmlhttp://www.debian.org/security/2009/dsa-1898http://www.debian.org/security/2009/dsa-1899http://www.ingate.com/Relnote.php?ver=481http://www.redhat.com/support/errata/RHSA-2009-1138.htmlhttp://www.securityfocus.com/bid/35452http://www.securitytracker.com/id?1022428http://www.vupen.com/english/advisories/2009/1639http://www.vupen.com/english/advisories/2009/1706http://www.vupen.com/english/advisories/2009/1829http://www.vupen.com/english/advisories/2009/3354https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11079https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00264.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-July/msg00337.html
2009-06-25
Published