Paul Wouters

O problema faz com que o libreswan reinicie em alguns cenários de retransmissão IKEv2 quando uma conexão está configurada para usar PreSharedKeys (authby=secret) e a conexão não consegue encontrar um segredo configurado correspondente. Isso pode levar a falhas repetidas e a uma negação de serviço, especialmente quando tal conexão é adicionada automaticamente na inicialização usando a palavra-chave auto=. A vulnerabilidade está relacionada ao uso de PreSharedKeys para criar a carga útil AUTH na troca IKE AUTH, permitindo que um invasor remoto execute um ataque de negação de serviço.

The issue allows remote attackers to cause a denial of service, resulting in an assert failure and daemon restart, via a crafted TS payload with an incorrect selector length. This is due to a missing check in the Traffic Selector parsing code that would reject malformed Traffic Selector payloads, leading to a double free and crash of the pluto daemon. It is noted that there is no remote code execution.

The issue is related to the lack of input data sanitization in the ipsec module of the Unbound DNS server, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. This can be triggered by a specially crafted IPSECKEY answer, but only if Unbound was compiled with `--enable-ipsecmod` support and ipsecmod is enabled and used in the configuration.

The issue allows remote attackers to cause a denial of service, resulting in an assertion failure and daemon restart. This occurs when a zero DH g^x value is present in a KE payload within an IKE packet. The affected software must be built with NSS for this issue to be exploitable.

The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and IKE daemon restart, via IKEv2 packets that lack expected payloads. This problem exists due to an incomplete fix for a previous issue.

The issue allows remote attackers to cause a denial of service, resulting in a crash, by sending a specially crafted IKE packet with a small length value and either no version or an invalid major number.

The issue allows local users to obtain sensitive information about the rhncfg-client actions by reading the /var/log/rhncfg-actions file due to weak permissions.

The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely.