[Pkg-swan-devel] [strongswan] 02/03: Fix authentication bypass (CVE-2014-2338)

[Yves-Alexis Perez]

This is an automated email from the git hooks/post-receive script.

corsac pushed a commit to branch wheezy-security
in repository strongswan.

commit 2d81c9e1b3d853d64d4de540bb148fc9f8ba35b6
Author: Yves-Alexis Perez <corsac at debian.org>
Date:   Thu Apr 3 21:20:51 2014 +0200

    Fix authentication bypass (CVE-2014-2338)
    
    * debian/patches:
      - CVE-2014-2338-4.x added, fix authentication bypass (CVE-2014-2338).
---
 debian/changelog                       |  8 ++++++++
 debian/patches/CVE-2014-2338-4.x.patch | 36 ++++++++++++++++++++++++++++++++++
 debian/patches/series                  |  1 +
 3 files changed, 45 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 11b7f3d..4a8696d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+strongswan (4.5.2-1.5+deb7u3) UNRELEASED; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * debian/patches:
+    - CVE-2014-2338-4.x added, fix authentication bypass (CVE-2014-2338).
+
+ -- Yves-Alexis Perez <corsac at debian.org>  Thu, 03 Apr 2014 21:19:49 +0200
+
 strongswan (4.5.2-1.5+deb7u2) wheezy-security; urgency=high
 
   * Non-maintainer upload by the Security Team.
diff --git a/debian/patches/CVE-2014-2338-4.x.patch b/debian/patches/CVE-2014-2338-4.x.patch
new file mode 100644
index 0000000..c99c323
--- /dev/null
+++ b/debian/patches/CVE-2014-2338-4.x.patch
@@ -0,0 +1,36 @@
+From c9c8d62037ba97a51cb34c41364821abf9c5d120 Mon Sep 17 00:00:00 2001
+From: Martin Willi <martin at revosec.ch>
+Date: Thu, 20 Feb 2014 16:08:43 +0100
+Subject: [PATCH] ikev2: Reject CREATE_CHILD_SA exchange on unestablished
+ IKE_SAs
+
+Prevents a responder peer to trick us into established state by starting
+IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH.
+
+Fixes CVE-2014-2338 for 4.4.x, 4.5.x and 4.6.x versions of strongSwan.
+---
+ src/libcharon/sa/task_manager.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/src/libcharon/sa/task_manager.c b/src/libcharon/sa/task_manager.c
+index 022a5e3..d5b02cf 100644
+--- a/src/libcharon/sa/task_manager.c
++++ b/src/libcharon/sa/task_manager.c
+@@ -737,6 +737,15 @@ static status_t process_request(private_task_manager_t *this,
+ 			case CREATE_CHILD_SA:
+ 			{	/* FIXME: we should prevent this on mediation connections */
+ 				bool notify_found = FALSE, ts_found = FALSE;
++
++				if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED ||
++					this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING)
++				{
++					DBG1(DBG_IKE, "received CREATE_CHILD_SA request for "
++						 "unestablished IKE_SA, rejected");
++					return FAILED;
++				}
++
+ 				enumerator = message->create_payload_enumerator(message);
+ 				while (enumerator->enumerate(enumerator, &payload))
+ 				{
+--
+1.8.1.2
diff --git a/debian/patches/series b/debian/patches/series
index 8cbdabe..4d5a04b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -4,3 +4,4 @@ debian-changes-4.5.2-1.1
 0001-Added-support-for-the-resolvconf-framework-in-resolv.patch
 0001-Check-return-value-of-ECDSA_Verify-correctly.patch
 CVE-2013-6075.patch
+CVE-2014-2338-4.x.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-swan/strongswan.git