SB2018100705 - Buffer overflow in strongswan (Alpine package)
Published: October 7, 2018
Security Bulletin ID
SB2018100705
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Buffer overflow (CVE-ID: CVE-2018-17540)
The vulnerability allows a remote attacker to perform denial of service attacks.
The vulnerability exists due to a boundary error when processing certificates within gmp plugin. A remote attacker can create a specially crafted certificate, pass it to the affected application and trigger application crash.
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=1cb8f327fe893b5f83d52d1e8686ca8085a15412
- https://git.alpinelinux.org/aports/commit/?id=d01a6eb23f238d10cc1b2a2e3cbfd15ca2f4b3c2
- https://git.alpinelinux.org/aports/commit/?id=5bf14e0f89d033ac01ad2d80fb49921dd7d35a2f
- https://git.alpinelinux.org/aports/commit/?id=e043f4360d1a4acefce7229bd7836a3db968e86c
- https://git.alpinelinux.org/aports/commit/?id=2103efcf25f1ef29921454f1fb1094ed3f86c33a