Description
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.strongswan.org/blog/2013/04/30/strongswan-5.0.4-released-%28cve-2013-2944%29.html ↗
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00121.html ↗
- http://www.debian.org/security/2013/dsa-2665 ↗
- http://www.securityfocus.com/bid/59580 ↗
- http://lists.opensuse.org/opensuse-updates/2013-05/msg00014.html ↗
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00010.html ↗
- http://download.strongswan.org/patches/10_openssl_ecdsa_signature_patch/strongswan-4.3.5-5.0.3_openssl_ecdsa_signature.patch ↗