#VU32362 Input validation error in strongSwan - CVE-2015-8023

Vulnerability identifier: #VU32362

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2015-8023

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
strongSwan
Server applications / Encryption software

Vendor: strongswan.org

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.

Mitigation
Install update from vendor's website.

Vulnerable software versions

strongSwan: 5.3.0 - 5.3.3

---

External links
https://lists.opensuse.org/opensuse-security-announce/2015-12/msg00025.html
https://lists.opensuse.org/opensuse-updates/2015-11/msg00139.html
https://www.debian.org/security/2015/dsa-3398
https://www.securityfocus.com/bid/84947
https://www.ubuntu.com/usn/USN-2811-1
https://www.strongswan.org/blog/2015/11/16/strongswan-vulnerability-(cve-2015-8023).html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.