NVD

Id
25654  
Name
CVE-2015-4171  
Description
strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.  
Reject
 
CVSS Version
2  
CVSS Score
2.6  
Severity
Low  
CVSS Base Score
2.6  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2015-06-10  
Modified Date
2016-11-28  
Seq
2015-4171  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
135738 25654 CVE-2015-4171 DSA-3282  View
135739 25654 CVE-2015-4171 [oss-security] 20150529 StrongSwan VPN client for Android leaks username to rouge server  View
135740 25654 CVE-2015-4171 [oss-security] 20150529 Re: StrongSwan VPN client for Android leaks username to rouge server  View
135741 25654 CVE-2015-4171 [oss-security] 20150608 Re: StrongSwan VPN client for Android leaks username to rouge server  View
135742 25654 CVE-2015-4171 74933  View
135743 25654 CVE-2015-4171 1032514  View
135744 25654 CVE-2015-4171 USN-2628-1  View
135745 25654 CVE-2015-4171 https://play.google.com/store/apps/details?id=org.strongswan.android  View
135746 25654 CVE-2015-4171 https://www.strongswan.org/blog/2015/06/08/strongswan-vulnerability-%2528cve-2015-4171%2529.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
7747 JVNDB-2015-003067 strongSwan および strongSwan VPN Client における資格情報を取得される脆弱性 strongSwan および strongSwan VPN Client は、IKEv2 接続の認証に EAP、または事前共有キーを使用する場合、すべての認証プロセスが完了するまでサーバ認証の制限を適用しないため、資格情報を取得される脆弱性が存在します。 CVE-2015-4171 81396 CVE-2015-4171 25654 2.6 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-003067.html 2015-06-08 2015-06-15 View