Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2964
[SECURITY] [DLA 1528-1] strongswan security update
3 October 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: strongswan
Publisher: Debian
Operating System: Debian GNU/Linux 8
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-17540
Reference: ESB-2018.2957
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2018/10/msg00001.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Package : strongswan
Version : 5.2.1-6+deb8u8
CVE ID : CVE-2018-17540
It was discovered that there was a denial-of-service vulnerability in
strongswan, a virtual private network (VPN) client and server.
Verification of an RSA signature with a very short public key caused an
integer underflow in a length check that resulted in a heap buffer
overflow.
For Debian 8 "Jessie", this issue has been fixed in strongswan version
5.2.1-6+deb8u8.
We recommend that you upgrade your strongswan packages.
Regards,
- - --
,''`.
: :' : Chris Lamb
`. `'` lamby@debian.org / chris-lamb.co.uk
`-
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAluzRa4ACgkQHpU+J9Qx
Hlj3Lw//elj08ME+zL/RCQyXhiYpQPl1PHyyhWEkm89NVfSBmPV2fY1UNygoz7hf
T4Z+iTjUwl24tq3KXVq9yNFJHkJVPPtm7KfT3wsJ14y1hWvTw6mdiY/8749XdRov
Bu6HvRZmvJB/lgTJCulSp7vok2lsD6vUFgMDz0s5DBfQZ77pRGBJohciqKfnfnUB
Ql8AQnhh+FRYh6un8FGvbC2kDUp3RMbeQgz1QbsJ+Wh75lDjNMt0pDrU1F7cN9Ij
FZiUR6/u2cpXnRSvDKuzO5lz4RYmRLaCG/wR6rKyd34e1AbHgXItkViau7IDtzwB
5kJJj41blbKAPzwLjbZUB206JIq1Qt3WdzwsMbUYMlKacr8CCE/si8B3C9CXXOlz
FCFVpeqTjgKxbq1SWqTNa6CejU+napLSvXiKXlGagQi90qYPrJSKwMN79ubB+vmD
jAHjgmquzrbELLDvFCAMeg/wwSf4U+c1SspLbNoHSSa4L8g5pJg4CiG/a+yhPf78
cdXrOTZqW18/7L86R2sCpQ3GASutcp7aPfJpCPKAOcHj33uaU8L5OUWkxTzT1Tc0
lanbDV47iqysRc/NSibEwGpOKvuLbUO3n/a9BsuhB72P/2Kz2CwXl4HMEEOLFOB0
ZaSBRmV0fVxg2kPzuCKaTO1HnFOlby1d7T4/8ERX+zLy6929x8o=
=vqor
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW7P0pWaOgq3Tt24GAQiMTA/+MmqKVS1X/U0ifYP0rb6gWWQOQcuz+7z6
BKdqU+MNF7TgeTta0Ctj2dsZJw1bT9mIdmUKqO+HPnOQrh3FD/MI96x82TcUCJE4
KlaGg+HJHBEXZbsJ16FVQyKbRobFFSq2tVtd1PY83VlmWCnzshUVm3Xj1Wjbn9CY
leMQqmWrU3GzuJZyZaQssKWv7Z0iySVCNaQKIFo+mfb+QU/wy6CSQmXd2oKnv1Va
LXchoEn4TlZaSlt/SBU9ngZYf0guoy4u3Kcbi/iHVAb/MQRTgdST/vMmXbq7wO+Z
fu5lkYjHYnM/9+4qZBkUH7EwZgBwpR/ok/YsSz65E1KOA/U//UpSvWefigA7lMzv
8kkXWQ6oCI0Kc2ONMTpKT3PcxxTnmcA60O+4yEo6GYrJabLVUYnBdjZJ/xNHzdtL
Fbo8O9SyMkjSSApt7eLnR634qi+4ZtUmYXLIebN+bSzgeKKZiCX3xunN+D7+wpq4
VRjbYVL9yJrevNc/yqRJcnPgVDfWEzQQpzSdh4ji4tEWMzEyRN/c3NDuFHDJ3SJV
vaCxKLPBCctkTA1CbVmi4xLqskWP1nr4Y6kQMucvX842mY6Do2UZahwfXQr0ZVdv
Rp7U3mXm6mfX5hQCTWUYKcqtY7uHy3tufzTlLKdosvLM4TcBtvTIirAFwGtqZ0Qo
ORjHtVBE4+8=
=Db2+
-----END PGP SIGNATURE-----