Bug 815236 - (CVE-2013-2944) VUL-0: CVE-2013-2944: strongswan: ECDSA signature vulnerability
(CVE-2013-2944)
VUL-0: CVE-2013-2944: strongswan: ECDSA signature vulnerability
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
maint:released:sle11-sp1:52125 maint:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2013-04-15 11:09 UTC by Sebastian Krahmer
Modified: 2013-10-14 15:46 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2013-04-15 11:09:07 UTC
EMBARGOED:

Dear strongSwan partner,

We have been informed by Kevin Wojtysiak about a security vulnerability
in strongSwan that he discovered.  If the strongSwan "openssl" plugin is
used for ECDSA signature verification, an empty, zeroed or otherwise
invalid signature is handled as a legitimate one.  CVE-2013-2944 has
been assigned for this vulnerability.

Affected are only installations that have enabled and loaded the OpenSSL
crypto backend (--enable-openssl).  Builds using the default crypto
backends are not affected.

While this new ECDSA vulnerability is very similar to the RSA signature
vulnerability CVE-2012-2388, it is not directly related.

To exploit the vulnerability, a connection definition using ECDSA
authentication is required.  An attacker presenting a forged signature
and/or certificate can authenticate as any legitimate user.  strongSwan
versions back to 4.3.5 and up to 5.0.3 are affected, using both IKEv1
and IKEv2.  Injecting code is not possible by such an attack.

The attached patch fixes the vulnerability and should apply to all
affected versions.  Please prepare updated releases and patch your
installations, but do not yet publicly disclose any information about
this vulnerability.  We want to give you as a partner enough time to
prepare new releases and will publicly disclose the vulnerability with
an updated strongSwan release on Tuesday April 30, 12:00 noon UTC.

Our apologies for having such a serious vulnerability in the strongSwan
codebase and thank you for respecting our responsible disclosure procedure.

Kind Regards
Tobias Brunner
strongSwan Developer
Comment 1 Sebastian Krahmer 2013-04-15 11:11:23 UTC
Created attachment 535157 [details]
attached fix

.
Comment 4 Swamp Workflow Management 2013-04-16 06:57:59 UTC
The SWAMPID for this issue is 52124.
This issue was rated as moderate.
Please submit fixed packages until 2013-04-30.
When done, please reassign the bug to security-team@suse.de.
Patchinfo will be handled by security team.
Comment 6 Sebastian Krahmer 2013-04-30 12:40:39 UTC
gone public

http://www.strongswan.org/strongswan-5.0.4-released-(cve-2013-2944).html
Comment 7 Bernhard Wiedemann 2013-04-30 13:00:07 UTC
This is an autogenerated message for OBS integration:
This bug (815236) was mentioned in
https://build.opensuse.org/request/show/173968 Maintenance / 
https://build.opensuse.org/request/show/173969 Maintenance / 
https://build.opensuse.org/request/show/173970 Maintenance /
Comment 8 Marius Tomaschewski 2013-04-30 13:13:28 UTC
OK, fixes for all released distributions + factory are submitted.
Comment 9 Bernhard Wiedemann 2013-04-30 14:00:15 UTC
This is an autogenerated message for OBS integration:
This bug (815236) was mentioned in
https://build.opensuse.org/request/show/173989 Factory / strongswan
Comment 10 Swamp Workflow Management 2013-05-10 15:04:36 UTC
openSUSE-SU-2013:0774-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 815236
CVE References: CVE-2013-2944
Sources used:
openSUSE 12.1 (src):    strongswan-4.5.3-5.11.1
Comment 11 Swamp Workflow Management 2013-05-10 15:04:49 UTC
openSUSE-SU-2013:0775-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 815236
CVE References: CVE-2013-2944
Sources used:
openSUSE 12.2 (src):    strongswan-4.6.4-2.8.1
Comment 12 Swamp Workflow Management 2013-06-10 09:05:24 UTC
openSUSE-SU-2013:0873-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 815236
CVE References: CVE-2013-2944
Sources used:
openSUSE 12.3 (src):    strongswan-5.0.1-4.4.1
Comment 13 Swamp Workflow Management 2013-06-10 10:29:22 UTC
openSUSE-SU-2013:0985-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 815236
CVE References: CVE-2013-2944
Sources used:
openSUSE 11.4 (src):    strongswan-4.5.0-6.52.1
Comment 14 Swamp Workflow Management 2013-07-23 12:04:21 UTC
Update released for: strongswan, strongswan-debuginfo, strongswan-debugsource, strongswan-doc
Products:
SLE-SERVER 11-SP1-TERADATA (x86_64)
Comment 15 Swamp Workflow Management 2013-07-23 13:53:09 UTC
Update released for: strongswan, strongswan-debuginfo, strongswan-debugsource, strongswan-doc
Products:
SLE-DEBUGINFO 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP2 (i386, x86_64)
SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP2 (i386, x86_64)
Comment 16 Swamp Workflow Management 2013-07-24 21:49:29 UTC
Update released for: strongswan, strongswan-debuginfo, strongswan-doc
Products:
SLE-DEBUGINFO 10-SP4 (i386, ia64, ppc, s390x, x86_64)
SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
Comment 17 Matthias Weckbecker 2013-08-01 12:34:36 UTC
released
Comment 18 Swamp Workflow Management 2013-08-01 14:49:07 UTC
Update released for: strongswan, strongswan-debuginfo, strongswan-debugsource, strongswan-doc
Products:
SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP3 (i386, x86_64)
SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP3 (i386, x86_64)
Comment 19 Matthias Weckbecker 2013-08-06 12:36:06 UTC
I think this can be closed. Fixed RPMs should be there. Freel free to reopen
if there's anything left.