The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2012-70:01 advisory.

    Openswan is a free implementation of IPsec & IKE for Linux.  IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services.  These services allow     youto build secure tunnels through untrusted networks.  Everything passing through the untrusted net is     encrypted by the ipsec gateway machine and decrypted by the gateway at the other end of the tunnel.  The     resulting tunnel is a virtual private network or VPN.
    This package contains the daemons and userland tools for setting up Openswan. It supports the NETKEY/XFRM     IPsec kernel stack that exists in the default Linux kernel.
    Openswan 2.6.x also supports IKEv2 (RFC4306)     Security issues fixed with this release:
    CVE-2011-4073     Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through     2.6.36 allows remote authenticated users to cause a denial of service (pluto IKE daemon crash) via vectors     related to the (1) quick_outI1_continue and (2) quick_outI1 functions.
    Fixed bugs:
     - When the ports were defined and the host was defined with its hostname, openswan did not handle     protocol and port configuration correctly. This has been fixed.
     - Previously, very large security label strings received from a peer were being truncated but still used.
    Those truncated strings could happen to be valid, lead ing to incorrect policy. This has been fixed.
     - Erroneous queuing of on-demand requests of setting up an IPsec connection was discovered in the IKEv2     (Internet Key Exchange) code. This is not intended and has been removed.
     - Openswan would process the AH (Authentication Header) mode as if it was the ESP (Encrypted Secure     Payload) mode, and then fail to set up AH mode security associations (SAs) because it was waiting for an     encryption key. This has been fixed.
     - If a specific port was configured, IPsec connections over a loopback interface did not work properly.
    This has been fixed.
     - Enabled the CRL functionality flags on compilation so that openswan supportretrieving Certificate     Revocation Lists (CRLs) from HTTP or LDAP CRL Distribution Points (CDPs).
     - Corrected the README.x509 file to provide accurate information regarding the directories to be scanned     for certification files. openswan now discovers all certificates.
     - The Network Manager padlock icon was not cleared after a VPN connection terminated unexpectedly. This     has been fixed.
     - Openswan sent wrong IKEv2 (Internet Key Exchange) ICMP (Internet Control Message Protocol) selectors to     an IPsec destination. This has been fixed.
     - When an IP address had been removed from end of an established IPsec tunnel and the other end of the     tunnel attempted to reuse the particular IP address to create a new tunnel, the Pluto daemon terminated     unexpectedly with a segmentation fault. This has been fixed.
    Enhancement:
     - Added the iptable-save command, which uses only iptables and does not load kernel modules, unlike the     ipsec barf and ipsec verify commands.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

openswan's crypto helper was prone to an use-after-free flaw which could potentially allow remote attackers to cause a Denial of Service (CVE-2011-4073, bnc#727002). Additionally, a potential dereference of a no longer valid pointer has been fixed.

The remote host is affected by the vulnerability described in GLSA-201203-13 (Openswan: Denial of Service)

    Two vulnerabilities have been found in Openswan:
      Improper permissions are used on /var/run/starter.pid and         /var/lock/subsys/ipsec (CVE-2011-2147).
      Openswan contains a use-after-free error in the cryptographic helper         handler (CVE-2011-4073).
  Impact :

    A remote authenticated attacker or a local attacker may be able to cause       a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Fixes for CVE-2011-4073.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

openswan's crypto helper was prone to an use-after-free flaw which could potentially allow remote attackers to cause a Denial of Service (CVE-2011-4073, bnc#727002). Additionally, the following issues have been fixed :

  - AH handshake problems (bnc#713986),

  - potential dereference of no longer valid pointers,

  - mode handling issues

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1422 advisory.

    Openswan is a free implementation of Internet Protocol Security (IPsec)     and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide     both authentication and encryption services. These services allow you to     build secure tunnels through untrusted networks.

    A use-after-free flaw was found in the way Openswan's pluto IKE daemon used     cryptographic helpers. A remote, authenticated attacker could send a     specially-crafted IKE packet that would crash the pluto daemon. This issue     only affected SMP (symmetric multiprocessing) systems that have the     cryptographic helpers enabled. The helpers are disabled by default on Red     Hat Enterprise Linux 5, but enabled by default on Red Hat Enterprise Linux     6. (CVE-2011-4073)

    Red Hat would like to thank the Openswan project for reporting this issue.
    Upstream acknowledges Petar Tsankov, Mohammad Torabi Dashti and David Basin     of the information security group at ETH Zurich as the original reporters.

    All users of openswan are advised to upgrade to these updated packages,     which contain a backported patch to correct this issue. After installing     this update, the ipsec service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
284023	MiracleLinux 4 : openswan-2.6.32-9.0.1.AXS4 (AXSA:2012-70:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	medium
57237	SuSE 10 Security Update : openswan (ZYPP Patch Number 7836)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	medium
58378	GLSA-201203-13 : Openswan: Denial of Service	Nessus	Gentoo Local Security Checks	2012/3/19	2021/1/6	medium
57071	Fedora 14 : openswan-2.6.33-3.fc14 (2011-15127)	Nessus	Fedora Local Security Checks	2011/12/12	2021/1/11	medium
57125	SuSE 11.1 Security Update : openswan (SAT Patch Number 5424)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	medium
56698	RHEL 6 : openswan (RHSA-2011:1422)	Nessus	Red Hat Local Security Checks	2011/11/3	2025/4/14	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium