CVE-2013-7294 The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a denial of service (restart) via an IKEv2 I1 notification without a KE payload.
MediumCVSS 5.0
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a denial of service (restart) via an IKEv2 I1 notification without a KE payload.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libreswan | <= 3.6 | No fix listed |
| libreswan | = 3.0 | No fix listed |
| libreswan | = 3.1 | No fix listed |
| libreswan | = 3.2 | No fix listed |
| libreswan | = 3.3 | No fix listed |
| libreswan | = 3.4 | No fix listed |
| libreswan | = 3.5 | No fix listed |
References
- 56276 third-party-advisory vendor-advisory
- 56915 third-party-advisory
- 101573 vdb-entry
- github.com exploit patch
- [Swan-announce] 20131211 Libreswan 3.7 released mailing-list vendor-advisory