CVE-2009-0790

strongswan 2.6-2.6.20, 2.4-2.4.13, 4.2-4.2.13, 2.8-2.8.8 - Denial of Service via Crafted DPD IKE Notification Message

Title source: llm
STIX 2.1

Description

The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.

References (17)

Core 17
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/49523
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34494
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11171
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34472
Patch vendor-advisory x_refsource_debian
http://www.debian.org/security/2009/dsa-1759
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0886
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021949
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34546
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/502270/100/0/threaded
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34483
Vendor Advisory x_refsource_confirm
http://www.openswan.org/CVE-2009-0790/CVE-2009-0790.txt
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021950
Vendor Advisory x_refsource_confirm
http://download.strongswan.org/CHANGES4.txt
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2009-0402.html
Patch vendor-advisory x_refsource_debian
http://www.debian.org/security/2009/dsa-1760
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34296

Scores

EPSS 0.0321
EPSS Percentile 86.7%

Details

CWE
CWE-20
Status published
Products (50)
strongswan/strongswan 2.4.0
strongswan/strongswan 2.4.0a
strongswan/strongswan 2.4.1
strongswan/strongswan 2.4.2
strongswan/strongswan 2.4.3
strongswan/strongswan 2.4.4
strongswan/strongswan 2.6.0
strongswan/strongswan 2.6.1
strongswan/strongswan 2.6.2
strongswan/strongswan 2.6.3
... and 40 more
Published Apr 01, 2009
Tracked Since Feb 18, 2026