03 May 2013, 09:15

Certificate bug in open source IPsec VPN

strongSwan logo The strongSwan open source IPsec VPN software potentially accepts invalid digital signatures and certificates for IPsec connections. The developers report that the issue affects versions 4.3.5 up to 5.0.3 – but only if the OpenSSL crypto backend is enabled using --enable-openssl; the default crypto libraries are not vulnerable.

The problem occurs when verifying signatures that are based on the Elliptic Curve Digital Signature Algorithm (ECDSA); if such signatures are verified using the OpenSSL plugin, strongSwan will handle empty, zeroed or otherwise invalid signatures as legitimate ones. The developers say that both IKEv1 and IKEv2 are affected.

If a connection definition with ECDSA authentication exists on the IPsec gateway, attackers can potentially use a forged digital signature or bogus certificate to gain unauthorised access. strongSwan 5.0.4 fixes the bug.

(sno)

« previous | next »

Print Version | Send by email | Permalink: http://h-online.com/-1855695