Secure testing team - Aug 2009 - Bug#540144: CVE-2009-2661: incomplete fix for CVE-2009-2185

Package: strongswan
Severity: serious
Tags: security patch

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for strongswan.

CVE-2009-2661[0]:
| The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before
| 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509
| certificates with crafted Relative Distinguished Names (RDNs), which
| allows remote attackers to cause a denial of service (pluto IKE daemon
| crash) via malformed ASN.1 data.  NOTE: this is due to an incomplete
| fix for CVE-2009-2185.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2661
    http://security-tracker.debian.net/tracker/CVE-2009-2661
    Patch: http://download.strongswan.org/patches/07_asn1_length_patch/

Cheers,
Giuseppe.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkp6f00ACgkQNxpp46476aqs8gCeJOTbmBQVtDZI7WJ5f/xy7tNk
F4oAni7A4FaHHaq/5CHSZfhZkdo9r2Jm
=mQTb
-----END PGP SIGNATURE-----