Unscored severity · published Apr 1, 2009
CVE-2009-0790
The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to…
–
CVSS
3.2%
EPSS
No
On KEV
Description
The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openswan · Xelerance
2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.5; +20 more · source: NVD
ST
Strongswan · Strongswan
2.4.0; 2.4.0a; 2.4.1; 2.4.2; 2.4.3; 2.4.4; +28 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0790
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0790
Vendor Advisory
http://download.strongswan.org/CHANGES4.txt
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html
Vendor Advisory
http://secunia.com/advisories/34472
Vendor Advisory
http://secunia.com/advisories/34483
Vendor Advisory
http://secunia.com/advisories/34494
Vendor Advisory
http://secunia.com/advisories/34546
More from Strongswan
9.8
CVE-2023-41913
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy
9.8
CVE-2023-26463
strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function
9.8
CVE-2015-3991
strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code
9.1
CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual…
8.1
CVE-2025-62291
In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow…