oss-sec mailing list archives
Re: CVE request: strongswam denial-of-service
From: "Steven M. Christey" <coley () linus mitre org>
Date: Tue, 14 Oct 2008 14:48:20 -0400 (EDT)
====================================================== Name: CVE-2008-4551 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4551 Reference: MISC:http://labs.mudynamics.com/advisories/MU-200809-01.txt Reference: CONFIRM:http://download.strongswan.org/CHANGES4.txt Reference: BID:31291 Reference: URL:http://www.securityfocus.com/bid/31291 Reference: FRSIRT:ADV-2008-2660 Reference: URL:http://www.frsirt.com/english/advisories/2008/2660 Reference: SECTRACK:1020903 Reference: URL:http://www.securitytracker.com/id?1020903 Reference: SECUNIA:31963 Reference: URL:http://secunia.com/advisories/31963 strongSwan 4.2.6 and earlier allows remote attackers to cause a denial of service (daemon crash) via an IKE_SA_INIT message with a large number of NULL values in a Key Exchange payload, which triggers a NULL pointer dereference for the return value of the mpz_export function in the GNU Multiprecision Library (GMP).
Current thread:
- CVE request: strongswam denial-of-service Thomas Biege (Oct 14)
- Re: CVE request: strongswam denial-of-service Steven M. Christey (Oct 14)