Vulnerability Name:

CVE-2014-2891 (CCN-93058)

Assigned:2014-05-07
Published:2014-05-07
Updated:2018-08-13
Summary:strongSwan before 5.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a crafted ID_DER_ASN1_DN ID payload.
Per: http://www.strongswan.org/blog/2014/05/05/strongswan-denial-of-service-vulnerability-%28cve-2014-2891%29.html

"Based on a crash report from one of our users we found that strongSwan versions before 5.1.2 are susceptible to a DoS vulnerability. Affected are strongSwan versions 4.3.3 and newer, up to 5.1.1. The latest release (5.1.3) is not affected."
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2014-2891

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2014:0697

Source: SUSE
Type: UNKNOWN
openSUSE-SU-2014:0700

Source: SECUNIA
Type: UNKNOWN
59864

Source: CCN
Type: strongSwan Web Site
strongSwan Authentication Bypass Vulnerability (CVE-2014-2338)

Source: DEBIAN
Type: UNKNOWN
DSA-2922

Source: CCN
Type: IBM Security Bulletin N1020860
Vulnerabilities in Strongswan affect Power Hardware Management Console (CVE-2014-9221,CVE-2014-2891,CVE-2014-2338,CVE-2013-5018)

Source: BID
Type: UNKNOWN
67212

Source: CCN
Type: BID-67212
strongSwan CVE-2014-2891 NULL Pointer Dereference Denial of Service Vulnerability

Source: CONFIRM
Type: UNKNOWN
http://www.strongswan.org/blog/2014/05/05/strongswan-denial-of-service-vulnerability-(cve-2014-2891).html

Source: CCN
Type: Red Hat Bugzilla Bug 1095487
CVE-2014-2891 strongswan: denial of service via crafted ID_DER_ASN1_DN_ID payload

Source: XF
Type: UNKNOWN
strongswan-cve20142891-dos(93058)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:debian:strongswan:*:*:*:*:*:*:*:* (Version <= 5.1.2)
  • OR cpe:/a:strongswan:strongswan:5.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:strongswan:strongswan:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:strongswan:strongswan:5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:strongswan:strongswan:5.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:strongswan:strongswan:5.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:strongswan:strongswan:5.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:strongswan:strongswan:*:*:*:*:*:*:*:* (Version <= 5.1.1)

    • Configuration CCN 1:
  • cpe:/a:strongswan:strongswan:5.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:strongswan:strongswan:5.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:strongswan:strongswan:5.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:strongswan:strongswan:5.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:strongswan:strongswan:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:strongswan:strongswan:5.0.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20142891
    V
    		CVE-2014-2891
    2022-05-20
    oval:org.opensuse.security:def:30168
    P
    		Security update for java-1_8_0-ibm (Important) (in QA)
    2022-01-04
    oval:org.opensuse.security:def:32218
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-11-19
    oval:org.opensuse.security:def:34568
    P
    		Security update for python3 (Moderate)
    2021-10-20
    oval:org.opensuse.security:def:55953
    P
    		Security update for sqlite3 (Important)
    2021-09-23
    oval:org.opensuse.security:def:26132
    P
    		Security update for MozillaFirefox (Important)
    2021-09-22
    oval:org.opensuse.security:def:56065
    P
    		Security update for libesmtp (Important)
    2021-09-02
    oval:org.opensuse.security:def:34479
    P
    		Security update for libsolv (Important)
    2021-06-28
    oval:org.opensuse.security:def:32131
    P
    		Security update for ovmf (Important)
    2021-06-22
    oval:org.opensuse.security:def:30094
    P
    		Security update for apache2 (Important)
    2021-06-17
    oval:org.opensuse.security:def:36298
    P
    		strongswan-4.4.0-6.25.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42705
    P
    		strongswan-4.4.0-6.25.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:56027
    P
    		Security update for gstreamer-plugins-bad (Important)
    2021-06-07
    oval:org.opensuse.security:def:30083
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:55196
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:30082
    P
    		Security update for libwebp (Critical)
    2021-06-02
    oval:org.opensuse.security:def:26051
    P
    		Security update for djvulibre (Important)
    2021-05-19
    oval:org.opensuse.security:def:34422
    P
    		Security update for samba (Important)
    2021-04-29
    oval:org.opensuse.security:def:32074
    P
    		Security update for MozillaFirefox (Important)
    2021-04-27
    oval:org.opensuse.security:def:54785
    P
    		Security update for nghttp2 (Important)
    2021-03-24
    oval:org.opensuse.security:def:55861
    P
    		Security update for git (Important)
    2021-03-09
    oval:org.opensuse.security:def:55302
    P
    		Security update for grub2 (Important)
    2021-03-02
    oval:org.opensuse.security:def:26189
    P
    		Security update for subversion (Important)
    2021-02-10
    oval:org.opensuse.security:def:57496
    P
    		Security update for openvswitch (Important)
    2021-02-02
    oval:org.opensuse.security:def:31570
    P
    		Security update for cyrus-sasl (Important)
    2020-12-28
    oval:org.opensuse.security:def:34324
    P
    		Security update for python-cryptography (Moderate)
    2020-12-04
    oval:org.opensuse.security:def:35581
    P
    		libadns1-1.4-73.21 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35622
    P
    		openvpn-2.0.9-143.31 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:26623
    P
    		pam on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27384
    P
    		cups-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34873
    P
    		Security update for CUPS
    2020-12-01
    oval:org.opensuse.security:def:25847
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:30389
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:32479
    P
    		LibVNCServer on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27587
    P
    		xorg-x11-libXt-devel-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25923
    P
    		Security update for util-linux (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30687
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:32584
    P
    		ntp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34093
    P
    		Security update for microcode_ctl (Important)
    2020-12-01
    oval:org.opensuse.security:def:27810
    P
    		Security update for libqt4
    2020-12-01
    oval:org.opensuse.security:def:31764
    P
    		Security update for MozillaFirefox, MozillaFirefox-branding-SLE and mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:30830
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28063
    P
    		Security update for expat (Important)
    2020-12-01
    oval:org.opensuse.security:def:31850
    P
    		Security update for clamav (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26477
    P
    		Security update for phpMyAdmin (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31532
    P
    		Security update for samba (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54645
    P
    		pam_ssh on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28160
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26579
    P
    		libMagickCore1-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27383
    P
    		ctdb-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34834
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:30300
    P
    		Security update for strongswan (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32430
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:27296
    P
    		strongswan on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27459
    P
    		libmikmod on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55753
    P
    		Security update for openssl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34943
    P
    		Security update for MozillaFirefox
    2020-12-01
    oval:org.opensuse.security:def:25859
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:30532
    P
    		Security update for java-1_6_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:32540
    P
    		krb5-doc on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34092
    P
    		Security update for mgetty (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27726
    P
    		Security update for evolution-data-server
    2020-12-01
    oval:org.opensuse.security:def:30791
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:33261
    P
    		strongswan on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34188
    P
    		Security update for openvpn (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28014
    P
    		Security update for audiofile (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57422
    P
    		Security update for poppler
    2020-12-01
    oval:org.opensuse.security:def:31776
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26424
    P
    		Security update for enigmail (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30894
    P
    		Security update for MozillaFirefox, mozilla-nspr, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:54623
    P
    		libwmf-0_2-7 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28116
    P
    		Security update for gnutls (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26565
    P
    		hplip on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55023
    P
    		telepathy-idle on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34785
    P
    		Security update for OpenEXR (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28833
    P
    		Security update for strongswan
    2020-12-01
    oval:org.opensuse.security:def:32374
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27261
    P
    		pcsc-ccid on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27395
    P
    		evolution on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55468
    P
    		Security update for freetype2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34899
    P
    		Security update for dhcp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25848
    P
    		Security update for flex, at, bogofilter, cyrus-imapd, kdelibs4, libQtWebKit4, libbonobo, mdbtools, netpbm, openslp, sgmltool, virtuoso, libqt5-qtwebkit (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30446
    P
    		Security update for CVS
    2020-12-01
    oval:org.opensuse.security:def:32518
    P
    		gd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27669
    P
    		Security update for rubygem-mail-2_3
    2020-12-01
    oval:org.opensuse.security:def:30742
    P
    		Security update for ansible (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33222
    P
    		pam_krb5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34104
    P
    		Security update for mozilla-nspr (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27961
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:56146
    P
    		Security update for librsvg (Low)
    2020-12-01
    oval:org.opensuse.security:def:31765
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26273
    P
    		Security update for libraw (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30850
    P
    		Security update for dhcp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54622
    P
    		libwebkit2gtk-3_0-25 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28102
    P
    		Security update for git (Important)
    2020-12-01
    oval:org.opensuse.security:def:31982
    P
    		Security update for java-1_7_1-ibm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26526
    P
    		bind on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34727
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28798
    P
    		Security update for OpenSLP
    2020-12-01
    oval:org.mitre.oval:def:26053
    P
    		SUSE-SU-2014:0793-1 -- Security update for strongswan
    2014-09-15
    oval:org.mitre.oval:def:24774
    P
    		DSA-2922-1 strongswan - security update
    2014-07-21
    oval:org.opensuse.security:def:80130
    P
    		Security update for strongswan
    2014-05-14
    oval:com.ubuntu.precise:def:20142891000
    V
    		CVE-2014-2891 on Ubuntu 12.04 LTS (precise) - medium.
    2014-05-07
    oval:com.ubuntu.trusty:def:20142891000
    V
    		CVE-2014-2891 on Ubuntu 14.04 LTS (trusty) - medium.
    2014-05-07
    oval:com.ubuntu.xenial:def:20142891000
    V
    		CVE-2014-2891 on Ubuntu 16.04 LTS (xenial) - medium.
    2014-05-07
    oval:com.ubuntu.xenial:def:201428910000000
    V
    		CVE-2014-2891 on Ubuntu 16.04 LTS (xenial) - medium.
    2014-05-07
    BACK
    debian strongswan *
    strongswan strongswan 5.0.0
    strongswan strongswan 5.0.1
    strongswan strongswan 5.0.2
    strongswan strongswan 5.0.3
    strongswan strongswan 5.0.4
    strongswan strongswan 5.1.0
    strongswan strongswan *
    strongswan strongswan 5.0.3
    strongswan strongswan 5.0.0
    strongswan strongswan 5.1.0
    strongswan strongswan 5.0.2
    strongswan strongswan 5.0.1
    strongswan strongswan 5.0.4