CVE

Id
92180  
CVE No.
CVE-2016-5361  
Status
Candidate  
Description
programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.  
Phase
Assigned (20160609)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
789620 92180 CVE-2016-5361 MLIST:[oss-security] 20160610 Re: CVE Request: IKEv1 protocol is vulnerable to DoS amplification attack  View
789621 92180 CVE-2016-5361 URL:http://www.openwall.com/lists/oss-security/2016/06/10/4  View
789622 92180 CVE-2016-5361 MLIST:[swan-dev] 20160313 Proposal: Do not retransmit IKEv1 reply for initial responder states  View
789623 92180 CVE-2016-5361 URL:https://lists.libreswan.org/pipermail/swan-dev/2016-March/001394.html  View
789624 92180 CVE-2016-5361 CONFIRM:https://github.com/libreswan/libreswan/commit/152d6d95632d8b9477c170f1de99bcd86d7fb1d6  View
789625 92180 CVE-2016-5361 REDHAT:RHSA-2016:2603  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
3715 JVNDB-2016-004488 複数の NUUO 製品および NETGEAR ReadyNAS Surveillance の __debugging_center_utils___.php における任意の PHP コードを実行される脆弱性 NUUO NVRmini 2、NVRsolo および NETGEAR ReadyNAS Surveillance の __debugging_center_utils___.php には、任意の PHP コードを実行される脆弱性が存在します。 CVE-2016-5674 92180 10 9.8 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004488.html  View