Package: strongswan
Severity: grave
Tags: security, patch
Justification: user security hole
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for strongswan.
CVE-2008-4551[0]:
| strongSwan 4.2.6 and earlier allows remote attackers to cause a denial
| of service (daemon crash) via an IKE_SA_INIT message with a large
| number of NULL values in a Key Exchange payload, which triggers a NULL
| pointer dereference for the return value of the mpz_export function in
| the GNU Multiprecision Library (GMP).
See also this report[1] and the upstream patch[2].
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
Cheers
Steffen
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4551
http://security-tracker.debian.net/tracker/CVE-2008-4551
[1] http://labs.mudynamics.com/advisories/MU-200809-01.txt
[2] http://wiki.strongswan.org/changeset/4345