NVD

Id
41256  
Name
CVE-2013-6075  
Description
The compare_dn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows (1) remote attackers to cause a denial of service (out-of-bounds read, NULL pointer dereference, and daemon crash) or (2) remote authenticated users to impersonate arbitrary users and bypass access restrictions via a crafted ID_DER_ASN1_DN ID, related to an "insufficient length check" during identity comparison.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-18  
Published
2013-11-02  
Modified Date
2013-11-21  
Seq
2013-6075  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
208809 41256 CVE-2013-6075 http://download.strongswan.org/security/CVE-2013-6075/strongswan-4.3.3-5.1.0_id_dn_match.patch  View
208810 41256 CVE-2013-6075 DSA-2789  View
208811 41256 CVE-2013-6075 http://www.strongswan.org/blog/2013/11/01/strongswan-denial-of-service-vulnerability-%28cve-2013-6075%29.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
23409 JVNDB-2013-004984 strongSwan の utils/identification.c の compare_dn 関数におけるサービス運用妨害 (DoS) の脆弱性 strongSwan の utils/identification.c の compare_dn 関数には、同一性確認中の "insufficient length check" に関連して、(1) サービス運用妨害 (out-of-bounds read、NULL ポインタデリファレンス、およびデーモンクラッシュ) 状態にされる、または (2) 任意のユーザになりすまされ、アクセス制限を回避される脆弱性が存在します。 CVE-2013-6075 66017 CVE-2013-6075 41256 5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-004984.html 2013-11-01 2013-11-05 View