CVE-2013-2052: Buffer Overflow

Published Jul 9, 2013

Updated

Buffer overflow in the atodn function in libreswan 3.0 and 3.1, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be the same vulnerability as CVE-2013-2053 and CVE-2013-2054.

Affected Software

2 affected components

libreswan Libreswan=3.0

libreswan Libreswan=3.1

Remediation

Patch Available

https://libreswan.org/security/CVE-2013-2052/CVE-2013-2052.txt

Event History

Jul 9, 2013

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-2052?

CVE-2013-2052 has a high severity rating as it allows for potential remote denial of service and arbitrary code execution.

How do I fix CVE-2013-2052?

To address CVE-2013-2052, upgrade to Libreswan version 3.1 or later where the vulnerability is patched.

What software is affected by CVE-2013-2052?

CVE-2013-2052 affects Libreswan versions 3.0 and 3.1 when Opportunistic Encryption is enabled.

What type of attack does CVE-2013-2052 allow?

CVE-2013-2052 enables remote attackers to execute a denial of service attack by exploiting a buffer overflow vulnerability.

What can be exploited in CVE-2013-2052?

CVE-2013-2052 can be exploited through crafted DNS TXT records to trigger a buffer overflow.