Unscored severity · published Aug 4, 2009
CVE-2009-2661
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished…
–
CVSS
1.6%
EPSS
No
On KEV
Description
The asn1_length function in strongSwan 2.8 before 2.8.11, 4.2 before 4.2.17, and 4.3 before 4.3.3 does not properly handle X.509 certificates with crafted Relative Distinguished Names (RDNs), which allows remote attackers to cause a denial of service (pluto IKE daemon crash) via malformed ASN.1 data. NOTE: this is due to an incomplete fix for CVE-2009-2185.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Strongswan · Strongswan
2.8.0; 2.8.1; 2.8.2; 2.8.3; 2.8.4; 2.8.5; +18 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2661
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2661
download.strongswan.org
http://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.3.x_asn1_length.patch
Patch
http://download.strongswan.org/patches/07_asn1_length_patch/strongswan-4.x.x_asn1_length.patch
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
secunia.com
http://secunia.com/advisories/36922
up2date.astaro.com
http://up2date.astaro.com/2009/08/up2date_7505_released.html
More from Strongswan
9.8
CVE-2023-41913
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy
9.8
CVE-2023-26463
strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function
9.8
CVE-2015-3991
strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code
9.1
CVE-2021-45079
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual…
8.1
CVE-2025-62291
In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow…