Denial of Service Vulnerability in Libreswan: Unauthenticated IKEv1 Aggressive Mode Packet Handling
Summary
DEBIAN-CVE-2023-30570: pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. Affects libreswan versions < 4.3-1+deb11u4. Fixed in 4.3-1+deb11u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libreswan is an open-source implementation of the Internet Key Exchange (IKE) and IPsec protocols, primarily used for establishing secure VPN connections. It is designed to provide secure communication over the internet by encrypting data and ensuring authentication between devices. The package is widely utilized in various Linux distributions, including Debian. However, it has been found to have a vulnerability that allows for denial of service attacks under specific conditions.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2023-30570, exists in the pluto component of Libreswan versions prior to 4.11. It allows an attacker to send unauthenticated IKEv1 Aggressive Mode packets, which can lead to mishandling of the responder SPI and cause the daemon to crash. This can result in a denial of service, disrupting the availability of VPN services for users. The earliest affected version is 3.28, highlighting the importance of updating to a secure version.
How To Fix
Minimum fixed version
4.3-1+deb11u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libreswanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the IKEv1 Aggressive Mode if it is not required for your VPN setup. This can help mitigate the risk of denial of service until the package is updated.
Conclusion
The vulnerability in Libreswan poses a significant risk of denial of service through specific packet handling issues. It is crucial for users to update their installations to the latest versions to ensure security and maintain the availability of their VPN services. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libreswan →
FAQ
The vulnerability allows for denial of service attacks through unauthenticated IKEv1 Aggressive Mode packets, leading to potential crashes of the daemon.
You can use Vulert, which monitors open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without any signup.
Versions of Libreswan prior to 4.11 are affected, with the earliest vulnerable version being 3.28.
Update your Libreswan package to the latest patched version as specified in the 'how to fix' section.
Yes, you can disable IKEv1 Aggressive Mode as a temporary workaround to reduce the risk of denial of service attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for libreswan.
