summaryrefslogtreecommitdiffstats
path: root/meta-networking/recipes-support/strongswan
diff options
context:
space:
mode:
authorYue Tao <Yue.Tao@windriver.com>2014-05-09 17:05:50 +0800
committerJoe MacDonald <joe@deserted.net>2014-05-09 10:18:40 -0400
commit6938319b3265f83a4bcc7fca31dec5c525a32022 (patch)
tree1d7c7f8c98c5fe41f0b487c19f065edf97b31ec6 /meta-networking/recipes-support/strongswan
parent9747141c09c641ce2364f246805be1682bbb7a9a (diff)
downloadmeta-openembedded-6938319b3265f83a4bcc7fca31dec5c525a32022.tar.gz
strongswan: Security Advisory - strongswan - CVE-2014-2338
IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2338 Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Joe MacDonald <joe@deserted.net>
Diffstat (limited to 'meta-networking/recipes-support/strongswan')
-rw-r--r--meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch36
-rw-r--r--meta-networking/recipes-support/strongswan/strongswan_5.1.1.bb1
2 files changed, 37 insertions, 0 deletions
diff --git a/meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch b/meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch
new file mode 100644
index 000000000..ad3459e99
--- /dev/null
+++ b/meta-networking/recipes-support/strongswan/files/strongswan-5.0.0-5.1.2_reject_child_sa.patch
@@ -0,0 +1,36 @@
1From b980ba7757dcfedd756aa055b3271ea58cf85aa6 Mon Sep 17 00:00:00 2001
2From: Martin Willi <martin@revosec.ch>
3Date: Thu, 20 Feb 2014 16:08:43 +0100
4Subject: [PATCH] ikev2: Reject CREATE_CHILD_SA exchange on unestablished
5 IKE_SAs
6
7Prevents a responder peer to trick us into established state by starting
8IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH.
9
10Fixes CVE-2014-2338 for 5.x versions of strongSwan.
11---
12 src/libcharon/sa/ikev2/task_manager_v2.c | 9 +++++++++
13 1 file changed, 9 insertions(+)
14
15diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c
16index ac3be90..a5252ab 100644
17--- a/src/libcharon/sa/ikev2/task_manager_v2.c
18+++ b/src/libcharon/sa/ikev2/task_manager_v2.c
19@@ -780,6 +780,15 @@ static status_t process_request(private_
20 case CREATE_CHILD_SA:
21 { /* FIXME: we should prevent this on mediation connections */
22 bool notify_found = FALSE, ts_found = FALSE;
23+
24+ if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED ||
25+ this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING)
26+ {
27+ DBG1(DBG_IKE, "received CREATE_CHILD_SA request for "
28+ "unestablished IKE_SA, rejected");
29+ return FAILED;
30+ }
31+
32 enumerator = message->create_payload_enumerator(message);
33 while (enumerator->enumerate(enumerator, &payload))
34 {
35--
361.8.1.2
diff --git a/meta-networking/recipes-support/strongswan/strongswan_5.1.1.bb b/meta-networking/recipes-support/strongswan/strongswan_5.1.1.bb
index a2a2333d6..f8116e3d0 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_5.1.1.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_5.1.1.bb
@@ -9,6 +9,7 @@ DEPENDS = "gmp openssl flex-native flex bison-native"
9 9
10SRC_URI = "http://download.strongswan.org/strongswan-${PV}.tar.bz2 \ 10SRC_URI = "http://download.strongswan.org/strongswan-${PV}.tar.bz2 \
11 file://fix-funtion-parameter.patch \ 11 file://fix-funtion-parameter.patch \
12 file://strongswan-5.0.0-5.1.2_reject_child_sa.patch \
12" 13"
13 14
14SRC_URI[md5sum] = "e3af3d493d22286be3cd794533a8966a" 15SRC_URI[md5sum] = "e3af3d493d22286be3cd794533a8966a"