StrongSwan IKEv2 SA Authentication Bypass Vulnerability (CVE-2014-2338)

Release date:
Updated on:

Affected Systems:
StrongSwan <5.1.3
Description:
--------------------------------------------------------------------------------
Bugtraq id: 66815
CVE (CAN) ID: CVE-2014-2338
 
StrongSwan is an IPsec-based open-source VPN solution for Linux.
 
An error occurs when strongSwan 4.0.7-5.1.2 processes the key update after an unestablished IKEv2 SA is started. This can cause bypassing the target authentication mechanism and obtaining unauthorized access permissions. Only active startup or re-verification of IKEv2 IKE_SAs version is affected.
 
<* Source: vendor

Link: http://secunia.com/advisories/57897/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
StrongSwan
----------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://www.strongswan.org/
Http://www.strongswan.org/blog/2014/04/14/strongswan-5.1.3-released.html
Http://strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-(cve-2014-233820..html