CVE-2014-2338: Medium severity strongSwan Strongswan vulnerability
Published Apr 16, 2014
·Updated
IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKESA during (1) initiation or (2) re-authentication, which triggers the IKESA state to be set to established.
Affected Software
57 affected components
strongSwan Strongswan=4.0.7
strongSwan Strongswan=4.1.0
strongSwan Strongswan=4.1.1
strongSwan Strongswan=4.1.2
strongSwan Strongswan=4.1.3
strongSwan Strongswan=4.1.4
strongSwan Strongswan=4.1.5
strongSwan Strongswan=4.1.6
strongSwan Strongswan=4.1.7
strongSwan Strongswan=4.1.8
strongSwan Strongswan=4.1.9
strongSwan Strongswan=4.1.10
strongSwan Strongswan=4.1.11
strongSwan Strongswan=4.2.0
strongSwan Strongswan=4.2.1
strongSwan Strongswan=4.2.2
strongSwan Strongswan=4.2.3
strongSwan Strongswan=4.2.4
strongSwan Strongswan=4.2.5
strongSwan Strongswan=4.2.6
strongSwan Strongswan=4.2.7
strongSwan Strongswan=4.2.8
strongSwan Strongswan=4.2.9
strongSwan Strongswan=4.2.10
strongSwan Strongswan=4.2.11
strongSwan Strongswan=4.2.12
strongSwan Strongswan=4.2.13
strongSwan Strongswan=4.2.14
strongSwan Strongswan=4.2.15
strongSwan Strongswan=4.2.16
strongSwan Strongswan=4.3.0
strongSwan Strongswan=4.3.1
strongSwan Strongswan=4.3.2
strongSwan Strongswan=4.3.3
strongSwan Strongswan=4.3.4
strongSwan Strongswan=4.3.5
strongSwan Strongswan=4.3.6
strongSwan Strongswan=4.3.7
strongSwan Strongswan=4.4.0
strongSwan Strongswan=4.4.1
strongSwan Strongswan=4.5.0
strongSwan Strongswan=4.5.1
strongSwan Strongswan=4.5.2
strongSwan Strongswan=4.5.3
strongSwan Strongswan=4.6.0
strongSwan Strongswan=4.6.1
strongSwan Strongswan=4.6.2
strongSwan Strongswan=4.6.3
strongSwan Strongswan=4.6.4
strongSwan Strongswan=5.0.0
strongSwan Strongswan=5.0.1
strongSwan Strongswan=5.0.2
strongSwan Strongswan=5.0.3
strongSwan Strongswan=5.0.4
strongSwan Strongswan=5.1.0
strongSwan Strongswan=5.1.1
strongSwan Strongswan=5.1.2
Event History
Apr 16, 2014
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:37 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2338?
CVE-2014-2338 is classified as a medium severity vulnerability due to its potential for remote attackers to bypass authentication.
2
How do I fix CVE-2014-2338?
To fix CVE-2014-2338, upgrade strongSwan to version 5.1.3 or later, which addresses this vulnerability.
3
Which versions of strongSwan are affected by CVE-2014-2338?
CVE-2014-2338 affects strongSwan versions from 4.0.7 to 5.1.2.
4
What does CVE-2014-2338 exploit?
CVE-2014-2338 exploits a vulnerability in the IKEv2 protocol allowing rekeying of an IKE_SA to establish state without proper authentication.
5
Is there a workaround for CVE-2014-2338?
There is no known workaround for CVE-2014-2338, so upgrading to a secure version is recommended.