Out-of-Bounds Buffer Read Vulnerability in Libreswan Daemon
Summary
CVE-2020-1763: An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Infor... Affects libreswan across 2 version ranges.
< 3.32-1
< 471a3e41a449d7c753bc4edbba4239501bb62ba8
Fixed in 3.32-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libreswan is an open-source implementation of the Internet Key Exchange (IKE) and IPsec protocols, primarily used for establishing secure VPN connections. It is designed to provide robust security features and is widely utilized in various networking environments. However, versions 3.27 to 3.31 of Libreswan contain a critical vulnerability that allows unauthenticated attackers to exploit the pluto daemon, potentially leading to service disruptions.
Vulnerability Detail
The vulnerability identified as CVE-2020-1763 is an out-of-bounds buffer read flaw in the pluto daemon of Libreswan. This issue arises when the daemon processes specially-crafted IKEv1 Informational Exchange packets, which can lead to a crash of the Libreswan service. An attacker can exploit this vulnerability without authentication, making it particularly dangerous. The daemon is designed to respawn after a crash, which could lead to repeated service interruptions if exploited continuously.
How To Fix
Minimum fixed version
3.32-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libreswanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Libreswan service to trusted networks only, thereby minimizing exposure to potential attackers. Additionally, monitoring network traffic for unusual IKEv1 packets may help in identifying and mitigating attacks.
Conclusion
CVE-2020-1763 represents a significant security risk for users of Libreswan versions 3.27 to 3.31. It is crucial to upgrade to version 3.32-1 or later to mitigate this vulnerability. Users should also consider implementing temporary workarounds and monitoring their systems for unusual activity until the upgrade can be completed.
See every vulnerability recorded for libreswan →
FAQ
CVE-2020-1763 is a vulnerability in the Libreswan pluto daemon that allows unauthenticated attackers to crash the service by sending specially-crafted packets.
Versions 3.27 to 3.31 of Libreswan are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by analyzing your manifest file. Visit Vulert Scanner to check for vulnerabilities without signup.
The CVSS score for CVE-2020-1763 is 7.5, indicating a high severity level.
If an immediate upgrade is not possible, consider implementing network restrictions and monitoring traffic to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for libreswan.
