Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2015:2183-2

Опубликовано: 21 дек. 2015
Источник: suse-cvrf

Описание

Security update for strongswan

The strongswan package was updated to fix the following security issue:

  • CVE-2015-8023: Fixed an authentication bypass vulnerability in the eap-mschapv2 plugin (bsc#953817).

Список пакетов

SUSE Linux Enterprise Desktop 12 SP1
strongswan-5.1.3-22.1
strongswan-doc-5.1.3-22.1
strongswan-ipsec-5.1.3-22.1
strongswan-libs0-5.1.3-22.1
SUSE Linux Enterprise Server 12 SP1
strongswan-5.1.3-22.1
strongswan-doc-5.1.3-22.1
strongswan-hmac-5.1.3-22.1
strongswan-ipsec-5.1.3-22.1
strongswan-libs0-5.1.3-22.1
SUSE Linux Enterprise Server for SAP Applications 12 SP1
strongswan-5.1.3-22.1
strongswan-doc-5.1.3-22.1
strongswan-hmac-5.1.3-22.1
strongswan-ipsec-5.1.3-22.1
strongswan-libs0-5.1.3-22.1

Ссылки

Описание

The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP1:strongswan-5.1.3-22.1
SUSE Linux Enterprise Desktop 12 SP1:strongswan-doc-5.1.3-22.1
SUSE Linux Enterprise Desktop 12 SP1:strongswan-ipsec-5.1.3-22.1
SUSE Linux Enterprise Desktop 12 SP1:strongswan-libs0-5.1.3-22.1
Ссылки