| Package | Affected versions | Patched versions |
|---|---|---|
| strongswan | = 2.4.0= 2.4.0a= 2.4.1= 2.4.2= 2.4.3= 2.4.4= 2.6.0= 2.6.1= 2.6.2= 2.6.3= 2.6.4= 2.8.0= 2.8.1= 2.8.2= 2.8.3= 2.8.4= 2.8.5= 2.8.6= 2.8.7= 2.8.8= 4.2.0= 4.2.1= 4.2.10= 4.2.11= 4.2.12= 4.2.13= 4.2.2= 4.2.3= 4.2.4= 4.2.5= 4.2.6= 4.2.7= 4.2.8= 4.2.9 | |
| openswan | = 2.4.0= 2.4.1= 2.4.10= 2.4.2= 2.4.3= 2.4.4= 2.4.5= 2.4.9= 2.6.03= 2.6.04= 2.6.05= 2.6.06= 2.6.07= 2.6.08= 2.6.09= 2.6.10= 2.6.11= 2.6.12= 2.6.13= 2.6.14= 2.6.15= 2.6.16= 2.6.17= 2.6.18= 2.6.19= 2.6.20 |
The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free