CVE-2011-3380

Published: 17 November 2011

Openswan 2.6.29 through 2.6.35 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto IKE daemon crash) via an ISAKMP message with an invalid KEY_LENGTH attribute, which is not properly handled by the error handling function.

Notes

Author	Note
mdeslaur	introduced in openswan 2.6.29

Priority

Status

Package	Release	Status
openswan Launchpad, Ubuntu, Debian	hardy	Not vulnerable (1:2.4.9+dfsg-1build1)
	lucid	Not vulnerable (1:2.6.23+dfsg-1ubuntu1)
	maverick	Not vulnerable (1:2.6.28+dfsg-1)
	natty	Not vulnerable (1:2.6.28+dfsg-5)
	upstream	Needs triage

References

https://www.cve.org/CVERecord?id=CVE-2011-3380
NVD
Launchpad
Debian

Bugs

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3380

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›