CVE-2013-6075
strongswan - Denial of service and authorization bypass
EPSS 2.4%
描述
The compare_dn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows (1) remote attackers to cause a denial of service (out-of-bounds read, NULL pointer dereference, and daemon crash) or (2) remote authenticated users to impersonate arbitrary users and bypass access restrictions via a crafted ID_DER_ASN1_DN ID, related to an "insufficient length check" during identity comparison.
如何修補 CVE-2013-6075
要修補 CVE-2013-6075,請將受影響套件升級到下列已修補版本。
- Debian/strongswan—升級至 5.1.0-3 或更新版本
- —升級至 4.4.1-5.4 或更新版本
CVE-2013-6075 正在被利用嗎?
低 — EPSS 為 2.4%,目前沒有觀察到大規模利用活動。
受影響套件(2)
- from 0, < 5.1.0-3
- from 0, < 4.4.1-5.4