Login Request a demo
Unscored severity · published Jul 9, 2013
CVE-2013-2053
Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be the same vulnerability as CVE-2013-2052 and CVE-2013-2054.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openswan · Xelerance
through 2.6.38; 2.6.01; 2.6.02; 2.6.03; 2.6.04; 2.6.05; +32 more · source: NVD
Affected product
OP
Openswan
Xelerance
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2053
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2053
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00008.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0827.html
www.debian.org
http://www.debian.org/security/2014/dsa-2893
www.securityfocus.com
http://www.securityfocus.com/bid/59838
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=960229
lists.libreswan.org
https://lists.libreswan.org/pipermail/swan-announce/2013/000003.html
More from Openswan
7.5
CVE-2018-15836
In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature…
3.1
CVE-2019-10155
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA…
–
CVE-2014-2037
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads
–
CVE-2013-6466
Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads
–
CVE-2011-4073
Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through 2.6.36 allows remote authenticated users to cause a denial of service…