CVE-2009-1957: Null Pointer Dereference
charon/sa/ikesa.c in the charon daemon in strongSWAN before 4.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid IKESAINIT request that triggers "an incomplete state," followed by a CREATECHILDSA request.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1957?
CVE-2009-1957 is a medium severity vulnerability that can lead to a denial of service due to a NULL pointer dereference in the strongSwan charon daemon.
How do I fix CVE-2009-1957?
To fix CVE-2009-1957, upgrade strongSwan to version 4.3.1 or later, which addresses the vulnerability.
What versions of strongSwan are affected by CVE-2009-1957?
CVE-2009-1957 affects strongSwan versions prior to 4.3.1, specifically 2.0.0 to 4.3.0.
Can CVE-2009-1957 be exploited remotely?
Yes, CVE-2009-1957 can be exploited remotely by sending a specially crafted IKE_SA_INIT request.
What impact does CVE-2009-1957 have on systems?
The impact of CVE-2009-1957 is a denial of service, causing the affected strongSwan service to crash.