CVE-2009-2661
published 2009-08-04CVE-2009-2661: The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted…
PriorityP422medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
1.58%
72.7th percentile
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | strongswan | < strongswan 4.3.2-1.1 (bookworm) | strongswan 4.3.2-1.1 (bookworm) |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
| strongswan | strongswan | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7j3p-ffqc-xjpg: The asn1_length function in strongSwan 2
ghsa_unreviewed·2022-05-02·CVSS 5.0
CVE-2009-2661 [MEDIUM] GHSA-7j3p-ffqc-xjpg: The asn1_length function in strongSwan 2
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
OSV
CVE-2009-2661: The asn1_length function in strongSwan 2
osv·2009-08-04·CVSS 5.0
CVE-2009-2661 [MEDIUM] CVE-2009-2661: The asn1_length function in strongSwan 2
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
Debian
CVE-2009-2661: strongswan - The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and...
vendor_debian·2009·CVSS 5.0
CVE-2009-2661 [MEDIUM] CVE-2009-2661: strongswan - The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and...
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
Scope: local
bookworm: resolved (fixed in 4.3.2-1.1)
bullseye: resolved (fixed in 4.3.2-1.1)
forky: resolved (fixed in 4.3.2-1.1)
sid: resolved (fixed in 4.3.2-1.1)
trixie: resolved (fixed in 4.3.2-1.1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.3.x_asn1_length.patchhttp://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.x.x_asn1_length.patchhttp://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.htmlhttp://secunia.com/advisories/36922http://up2date.astaro.com/2009/08/up2date_7505_released.htmlhttp://www.debian.org/security/2009/dsa-1899http://www.openwall.com/lists/oss-security/2009/07/27/1http://www.vupen.com/english/advisories/2009/2247https://lists.strongswan.org/pipermail/announce/2009-July/000056.htmlhttp://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.3.x_asn1_length.patchhttp://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.x.x_asn1_length.patchhttp://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.htmlhttp://secunia.com/advisories/36922http://up2date.astaro.com/2009/08/up2date_7505_released.htmlhttp://www.debian.org/security/2009/dsa-1899http://www.openwall.com/lists/oss-security/2009/07/27/1http://www.vupen.com/english/advisories/2009/2247https://lists.strongswan.org/pipermail/announce/2009-July/000056.html
2009-08-04
Published