CVE-2009-1957

Priority
Medium
Description
charon/sa/ike_sa.c in the charon daemon in strongSWAN before 4.3.1 allows
remote attackers to cause a denial of service (NULL pointer dereference and
crash) via an invalid IKE_SA_INIT request that triggers "an incomplete
state," followed by a CREATE_CHILD_SA request.
References
Bugs
Package
Upstream:needs-triage
Ubuntu 8.04 LTS (Hardy Heron):ignored (reached end-of-life)
Ubuntu 10.04 LTS (Lucid Lynx):not-affected (4.3.2-1.1ubuntu1)
Ubuntu 11.04 (Natty Narwhal):not-affected (4.3.2-1.1ubuntu1)
Ubuntu 11.10 (Oneiric Ocelot):not-affected (4.3.2-1.1ubuntu1)
Ubuntu 12.04 LTS (Precise Pangolin):not-affected (4.3.2-1.1ubuntu1)
Patches:
Upstream:http://download.strongswan.org/patches/03_invalid_ike_state_patch/strongswan-4.x.x_invalid_ike_state.patch
More Information

Valid XHTML 1.0 Strict

Updated: 2012-06-01 15:19:55 UTC (commit 5347)