exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Debian Security Advisory 4309-1

Debian Security Advisory 4309-1
Posted Oct 2, 2018
Authored by Debian | Site debian.org

Debian Linux Security Advisory 4309-1 - Google's OSS-Fuzz revealed an exploitable bug in the gmp plugin caused by the patch that fixes CVE-2018-16151 and CVE-2018-16151 (DSA-4305-1).

tags | advisory
systems | linux, debian
advisories | CVE-2018-17540
SHA-256 | 96ebef4ace5410d2453a7d17547810711deec7bc04cbe57c3f6d17da73bd9d81

Debian Security Advisory 4309-1

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4309-1 security@debian.org
https://www.debian.org/security/ Yves-Alexis Perez
October 01, 2018 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : strongswan
CVE ID : CVE-2018-17540

Google's OSS-Fuzz revealed an exploitable bug in the gmp plugin caused by the
patch that fixes CVE-2018-16151 and CVE-2018-16151 (DSA-4305-1).

An attacker could trigger it using crafted certificates with RSA keys with
very small moduli. Verifying signatures with such keys would cause an integer
underflow and subsequent heap buffer overflow resulting in a crash of the
daemon. While arbitrary code execution is not completely ruled out because of
the heap buffer overflow, due to the form of the data written to the buffer
it seems difficult to actually exploit it in such a way.

For the stable distribution (stretch), this problem has been fixed in
version 5.5.1-4+deb9u4.

We recommend that you upgrade your strongswan packages.

For the detailed security status of strongswan please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/strongswan

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAluzH80ACgkQ3rYcyPpX
RFvI5wf8DILbxELj4t7YjgZyT0pKzqSm2fDVO/Xjl6hj0Fnf6XidEvNx764NFoCo
x6MBILJohIAbzZo/3sT41vAuKKMfiasuUY0KSz4hHgRlwLqiNBOOTuKrR1PhrtmS
BKJg9PRfi0a+dwb2J0+UkKcaZQYMItqEBCjsZkF46lBFSx+dgs6spbSy3MmiY0ve
szxg/JyRLS6WLE87R8AUrBskPwcYu3jhjg53E02VnpKB+UXXb6NWC9D2zlpWRilx
9RQPofwjWNYoM7pM1QITPuUeFR5ia+7X7BA9SL7McMV6BWGimVCDEMZshTpqRTME
dOx9vpXrO5JZwMFk2hkxhFoA6ewo2g==
=L68k
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    16 Files
  • 10
    Sep 10th
    38 Files
  • 11
    Sep 11th
    21 Files
  • 12
    Sep 12th
    40 Files
  • 13
    Sep 13th
    18 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    21 Files
  • 17
    Sep 17th
    51 Files
  • 18
    Sep 18th
    23 Files
  • 19
    Sep 19th
    48 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close