diff options
| author | Romain Francoise <rfrancoise@debian.org> | 2014-04-08 20:10:55 +0200 |
|---|---|---|
| committer | Romain Francoise <rfrancoise@debian.org> | 2014-04-08 20:10:55 +0200 |
| commit | c029b6adbcf704bbd05455a6efb2c9f96bd7e8d5 (patch) | |
| tree | 10c006b162835417533b84ccb1cfb5f6b02d188e /debian | |
| parent | 0410259610ceb2f7d1791a8c40e5d5aa91c297d5 (diff) | |
| download | vyos-strongswan-c029b6adbcf704bbd05455a6efb2c9f96bd7e8d5.tar.gz vyos-strongswan-c029b6adbcf704bbd05455a6efb2c9f96bd7e8d5.zip | |
add CVE-2014-2338 patch from upstream
Diffstat (limited to 'debian')
| -rw-r--r-- | debian/patches/04_cve-2014-2338.patch | 36 | ||||
| -rw-r--r-- | debian/patches/series | 1 |
2 files changed, 37 insertions, 0 deletions
diff --git a/debian/patches/04_cve-2014-2338.patch b/debian/patches/04_cve-2014-2338.patch new file mode 100644 index 000000000..688245ce8 --- /dev/null +++ b/debian/patches/04_cve-2014-2338.patch @@ -0,0 +1,36 @@ +From b980ba7757dcfedd756aa055b3271ea58cf85aa6 Mon Sep 17 00:00:00 2001 +From: Martin Willi <martin@revosec.ch> +Date: Thu, 20 Feb 2014 16:08:43 +0100 +Subject: [PATCH] ikev2: Reject CREATE_CHILD_SA exchange on unestablished + IKE_SAs + +Prevents a responder peer to trick us into established state by starting +IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH. + +Fixes CVE-2014-2338 for 5.x versions of strongSwan. +--- + src/libcharon/sa/ikev2/task_manager_v2.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c +index ac3be90..a5252ab 100644 +--- a/src/libcharon/sa/ikev2/task_manager_v2.c ++++ b/src/libcharon/sa/ikev2/task_manager_v2.c +@@ -778,6 +778,15 @@ static status_t process_request(private_task_manager_t *this, + case CREATE_CHILD_SA: + { /* FIXME: we should prevent this on mediation connections */ + bool notify_found = FALSE, ts_found = FALSE; ++ ++ if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED || ++ this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING) ++ { ++ DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " ++ "unestablished IKE_SA, rejected"); ++ return FAILED; ++ } ++ + enumerator = message->create_payload_enumerator(message); + while (enumerator->enumerate(enumerator, &payload)) + { +-- +1.8.1.2 diff --git a/debian/patches/series b/debian/patches/series index d31e3c5c2..694043aa7 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,3 +1,4 @@ 01_fix-manpages.patch 02_unit-tests-Fix-filtered-enumerator-tests-on-64-bit-b.patch 03_unit-tests-Fix-chunk-clear-armel.patch +04_cve-2014-2338.patch |