CVE-2017-11185

Publication date 18 August 2017

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
strongswan	17.04 zesty	Fixed 5.5.1-1ubuntu3.2
	16.04 LTS xenial	Fixed 5.3.5-1ubuntu3.4
	14.04 LTS trusty	Fixed 5.1.2-0ubuntu2.7

Notes

sdeziel

Remote code execution is not possible.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
strongswan	Upstream: https://wiki.strongswan.org/projects/strongswan/repository/revisions/ef5c37fcdf47273feea320091598135688df4ef7 Upstream: https://download.strongswan.org/security/CVE-2017-11185/strongswan-4.4.0-5.5.3_gmp_mpz_export.patch

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

USN-3397-1
strongSwan vulnerability
21 August 2017