CVE-2013-5018: Buffer Overflow
The isasn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1length function, which allows remote attackers to cause a denial of service (segmentation fault) via a (1) XAuth username, (2) EAP identity, or (3) PEM encoded file that starts with a 0x04, 0x30, or 0x31 character followed by an ASN.1 length value that triggers an integer overflow.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5018?
CVE-2013-5018 has a moderate severity rating due to its potential to cause denial of service.
How do I fix CVE-2013-5018?
To fix CVE-2013-5018, you should upgrade strongSwan to a version later than 5.0.4.
What versions of strongSwan are affected by CVE-2013-5018?
CVE-2013-5018 affects strongSwan versions 4.1.11 through 5.0.4.
Can CVE-2013-5018 be exploited remotely?
Yes, CVE-2013-5018 can be exploited remotely by sending specially crafted input.
What kind of attacks can CVE-2013-5018 enable?
CVE-2013-5018 can enable attackers to cause a segmentation fault leading to a denial of service.