NVD

Id
28372  
Name
CVE-2015-8023  
Description
The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2015-11-18  
Modified Date
2016-12-07  
Seq
2015-8023  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
149145 28372 CVE-2015-8023 SUSE-SU-2015:2183  View
149146 28372 CVE-2015-8023 openSUSE-SU-2015:2103  View
149147 28372 CVE-2015-8023 DSA-3398  View
149148 28372 CVE-2015-8023 84947  View
149149 28372 CVE-2015-8023 USN-2811-1  View
149150 28372 CVE-2015-8023 https://www.strongswan.org/blog/2015/11/16/strongswan-vulnerability-(cve-2015-8023).html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
10667 JVNDB-2015-005987 strongSwan の eap-mschapv2 プラグインの EAP-MSCHAPv2 プロトコルのサーバの実装における認証を回避される脆弱性 strongSwan の eap-mschapv2 プラグインの EAP-MSCHAPv2 プロトコルのサーバの実装は、ローカルステートを適切に検証しないため、認証を回避される脆弱性が存在します。 CVE-2015-8023 85248 CVE-2015-8023 28372 5 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-005987.html 2015-11-16 2015-11-20 View