CVE-2013-7294

Exploit

EPSS 0.9%
Veröffentlicht 16.01.2014 05:05:26
Zuletzt bearbeitet 11.04.2025 00:51:21
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a denial of service (restart) via an IKEv2 I1 notification without a KE payload.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Libreswan ≫ Libreswan Version <= 3.6

Libreswan ≫ Libreswan Version3.0

Libreswan ≫ Libreswan Version3.1

Libreswan ≫ Libreswan Version3.2

Libreswan ≫ Libreswan Version3.3

Libreswan ≫ Libreswan Version3.4

Libreswan ≫ Libreswan Version3.5

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.9%	0.735

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:N/A:P

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://secunia.com/advisories/56276

Vendor Advisory

https://lists.libreswan.org/pipermail/swan-announce/2013/000007.html

Vendor Advisory

http://secunia.com/advisories/56915

http://www.osvdb.org/101573

https://github.com/libreswan/libreswan/commit/2899351224fe2940aec37d7656e1e392c0fe07f0

Patch

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2013-7294

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-7294

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-7294

EUVD