CVE-2015-3240 The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of service (assertion failure and daemon restart) via a zero DH...
MediumCVSS 4.3
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of service (assertion failure and daemon restart) via a zero DH g^x value in a KE payload in a IKE packet.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libreswan | = 3.14 | No fix listed |
References
- RHSA-2015:1979 vendor-advisory
- www.oracle.com
- 77536 vdb-entry
- 1033418 vdb-entry
- libreswan.org vendor-advisory
- [Openswan Users] 20150827 Openswan 2.6.45 released mailing-list vendor-advisory
- GLSA-201603-13 vendor-advisory
- Debian Security Tracker CVE-2015-3240 vendor-advisory