CVE-2009-0790
Fixed in a distro release EPSS 3%
The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.
Products: strongswan, xelerance openswan
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | strongswan | 4.2.14-1 |
| Debian 13 | strongswan | 4.2.14-1 |
| Debian 14 | strongswan | 4.2.14-1 |
| Debian 4.0 | openswan | 1:2.4.6+dfsg.2-1.1+etch1 |
| Debian 4.0 | strongswan | 2.8.0+dfsg-1+etch1 |
| Debian 5.0 | openswan | 1:2.4.12+dfsg-1.3+lenny1 |
| Debian 5.0 | strongswan | 4.2.4-5+lenny1 |
| Red Hat Enterprise Linux 5 | openswan | 0:2.6.14-1.el5_3.2 |
| Red Hat Enterprise Linux 5 | openswan-debuginfo | 0:2.6.14-1.el5_3.2 |
| Red Hat Enterprise Linux 5 | openswan-doc | 0:2.6.14-1.el5_3.2 |
| openSUSE Tumbleweed | strongswan | 5.3.5-1.1 |