CVE-2015-8023: Input Validation
First published: Wed Nov 18 2015(Updated: )
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =15.04 | |
| Canonical Ubuntu Linux | =15.10 | |
| Strongswan Strongswan | =4.2.12 | |
| Strongswan Strongswan | =4.2.13 | |
| Strongswan Strongswan | =4.2.14 | |
| Strongswan Strongswan | =4.2.15 | |
| Strongswan Strongswan | =4.2.16 | |
| Strongswan Strongswan | =4.3.0 | |
| Strongswan Strongswan | =4.3.1 | |
| Strongswan Strongswan | =4.3.2 | |
| Strongswan Strongswan | =4.3.3 | |
| Strongswan Strongswan | =4.3.4 | |
| Strongswan Strongswan | =4.3.5 | |
| Strongswan Strongswan | =4.3.6 | |
| Strongswan Strongswan | =4.3.7 | |
| Strongswan Strongswan | =4.4.0 | |
| Strongswan Strongswan | =4.4.1 | |
| Strongswan Strongswan | =4.5.0 | |
| Strongswan Strongswan | =4.5.1 | |
| Strongswan Strongswan | =4.5.2 | |
| Strongswan Strongswan | =4.5.3 | |
| Strongswan Strongswan | =4.6.0 | |
| Strongswan Strongswan | =4.6.1 | |
| Strongswan Strongswan | =4.6.2 | |
| Strongswan Strongswan | =4.6.3 | |
| Strongswan Strongswan | =4.6.4 | |
| Strongswan Strongswan | =5.0.0 | |
| Strongswan Strongswan | =5.0.1 | |
| Strongswan Strongswan | =5.0.2 | |
| Strongswan Strongswan | =5.0.3 | |
| Strongswan Strongswan | =5.0.4 | |
| Strongswan Strongswan | =5.1.0 | |
| Strongswan Strongswan | =5.1.1 | |
| Strongswan Strongswan | =5.1.2 | |
| Strongswan Strongswan | =5.1.3 | |
| Strongswan Strongswan | =5.2.0 | |
| Strongswan Strongswan | =5.2.1 | |
| Strongswan Strongswan | =5.2.2 | |
| Strongswan Strongswan | =5.2.3 | |
| Strongswan Strongswan | =5.3.0 | |
| Strongswan Strongswan | =5.3.1 | |
| Strongswan Strongswan | =5.3.2 | |
| Strongswan Strongswan | =5.3.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00025.html
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00139.html
- http://www.debian.org/security/2015/dsa-3398
- http://www.securityfocus.com/bid/84947
- http://www.ubuntu.com/usn/USN-2811-1
- https://www.strongswan.org/blog/2015/11/16/strongswan-vulnerability-(cve-2015-8023).html
- https://www.strongswan.org/blog/2015/11/16/strongswan-vulnerability-%28cve-2015-8023%29.html
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/15.04
- version/canonical ubuntu linux/15.10
- vendor/strongswan
- canonical/strongswan strongswan
- version/strongswan strongswan/4.2.12
- version/strongswan strongswan/4.2.13
- version/strongswan strongswan/4.2.14
- version/strongswan strongswan/4.2.15
- version/strongswan strongswan/4.2.16
- version/strongswan strongswan/4.3.0
- version/strongswan strongswan/4.3.1
- version/strongswan strongswan/4.3.2
- version/strongswan strongswan/4.3.3
- version/strongswan strongswan/4.3.4
- version/strongswan strongswan/4.3.5
- version/strongswan strongswan/4.3.6
- version/strongswan strongswan/4.3.7
- version/strongswan strongswan/4.4.0
- version/strongswan strongswan/4.4.1
- version/strongswan strongswan/4.5.0
- version/strongswan strongswan/4.5.1
- version/strongswan strongswan/4.5.2
- version/strongswan strongswan/4.5.3
- version/strongswan strongswan/4.6.0
- version/strongswan strongswan/4.6.1
- version/strongswan strongswan/4.6.2
- version/strongswan strongswan/4.6.3
- version/strongswan strongswan/4.6.4
- version/strongswan strongswan/5.0.0
- version/strongswan strongswan/5.0.1
- version/strongswan strongswan/5.0.2
- version/strongswan strongswan/5.0.3
- version/strongswan strongswan/5.0.4
- version/strongswan strongswan/5.1.0
- version/strongswan strongswan/5.1.1
- version/strongswan strongswan/5.1.2
- version/strongswan strongswan/5.1.3
- version/strongswan strongswan/5.2.0
- version/strongswan strongswan/5.2.1
- version/strongswan strongswan/5.2.2
- version/strongswan strongswan/5.2.3
- version/strongswan strongswan/5.3.0
- version/strongswan strongswan/5.3.1
- version/strongswan strongswan/5.3.2
- version/strongswan strongswan/5.3.3