NVD

Id
40486  
Name
CVE-2013-5018  
Description
The is_asn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1_length function, which allows remote attackers to cause a denial of service (segmentation fault) via a (1) XAuth username, (2) EAP identity, or (3) PEM encoded file that starts with a 0x04, 0x30, or 0x31 character followed by an ASN.1 length value that triggers an integer overflow.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-18  
Published
2013-08-28  
Modified Date
2016-11-28  
Seq
2013-5018  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
205417 40486 CVE-2013-5018 openSUSE-SU-2013:1332  View
205418 40486 CVE-2013-5018 openSUSE-SU-2013:1333  View
205419 40486 CVE-2013-5018 openSUSE-SU-2013:1372  View
205420 40486 CVE-2013-5018 http://strongswan.org/blog/2013/08/01/strongswan-5.1.0-released.html  View
205421 40486 CVE-2013-5018 http://strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html  View
205422 40486 CVE-2013-5018 61564  View
205423 40486 CVE-2013-5018 [Users] 20130729 [strongSwan] charon crash right after xauth+rsa client connects (strongswan-5.0.4, ubuntu 12.04)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
22339 JVNDB-2013-003914 strongSwan の is_asn1 関数におけるサービス運用妨害 (DoS) の脆弱性 strongSwan の is_asn1 関数は、asn1_length 関数の戻り値を適切に検証しないため、サービス運用妨害 (セグメンテーション違反) 状態にされる脆弱性が存在します。 CVE-2013-5018 64960 CVE-2013-5018 40486 4.3 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-003914.html 2013-08-01 2013-08-30 View