Debian LTS: Security Advisory for strongswan (DLA-2788-1)

The remote host is missing an update for the 'strongswan' package(s) announced via the DLA-2788-1 advisory.

Researchers at the United States of America National Security Agency (NSA) identified a denial of services vulnerability in strongSwan, an IKE/IPsec suite. Once the in-memory certificate cache is full it tries to randomly replace lesser used entries. Depending on the generated random value, this could lead to an integer overflow that results in a double-dereference and a call using out-of-bounds memory that most likely leads to a segmentation fault. Remote code execution can't be ruled out completely, but attackers have no control over the dereferenced memory, so it seems unlikely at this point.

'strongswan' package(s) on Debian Linux.

Checks if a vulnerable package version is present on the target host.

For Debian 9 stretch, this problem has been fixed in version 5.5.1-4+deb9u5. We recommend that you upgrade your strongswan packages.