From 0eb55942f3a31310cb2985b625fcc5960b39aac9 Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Tue, 15 Apr 2014 21:20:46 +0200 Subject: [PATCH] strongswan: Fix CVE-2014-2338. http://www.strongswan.org/blog/2014/04/14/strongswan-authentication-bypass-vulnerability-%28cve-2014-2338%29.html --- lfs/strongswan | 1 + ...rongswan-5.0.0-5.1.2_reject_child_sa.patch | 36 +++++++++++++++++++ 2 files changed, 37 insertions(+) create mode 100644 src/patches/strongswan-5.0.0-5.1.2_reject_child_sa.patch diff --git a/lfs/strongswan b/lfs/strongswan index 495d035991..e2fb50b17f 100644 --- a/lfs/strongswan +++ b/lfs/strongswan @@ -81,6 +81,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-4.5.3_ipfire.patch cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-5.1.1-delay-dpd.patch + cd $(DIR_APP) && patch -Np1 -i $(DIR_SRC)/src/patches/strongswan-5.0.0-5.1.2_reject_child_sa.patch cd $(DIR_APP) && [ -x "configure" ] || ./autogen.sh cd $(DIR_APP) && ./configure \ diff --git a/src/patches/strongswan-5.0.0-5.1.2_reject_child_sa.patch b/src/patches/strongswan-5.0.0-5.1.2_reject_child_sa.patch new file mode 100644 index 0000000000..688245ce89 --- /dev/null +++ b/src/patches/strongswan-5.0.0-5.1.2_reject_child_sa.patch @@ -0,0 +1,36 @@ +From b980ba7757dcfedd756aa055b3271ea58cf85aa6 Mon Sep 17 00:00:00 2001 +From: Martin Willi +Date: Thu, 20 Feb 2014 16:08:43 +0100 +Subject: [PATCH] ikev2: Reject CREATE_CHILD_SA exchange on unestablished + IKE_SAs + +Prevents a responder peer to trick us into established state by starting +IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH. + +Fixes CVE-2014-2338 for 5.x versions of strongSwan. +--- + src/libcharon/sa/ikev2/task_manager_v2.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c +index ac3be90..a5252ab 100644 +--- a/src/libcharon/sa/ikev2/task_manager_v2.c ++++ b/src/libcharon/sa/ikev2/task_manager_v2.c +@@ -778,6 +778,15 @@ static status_t process_request(private_task_manager_t *this, + case CREATE_CHILD_SA: + { /* FIXME: we should prevent this on mediation connections */ + bool notify_found = FALSE, ts_found = FALSE; ++ ++ if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED || ++ this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING) ++ { ++ DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " ++ "unestablished IKE_SA, rejected"); ++ return FAILED; ++ } ++ + enumerator = message->create_payload_enumerator(message); + while (enumerator->enumerate(enumerator, &payload)) + { +-- +1.8.1.2 -- 2.39.5