Cloudanix VulnDB

CVE-2014-9221

None

CVSS

—

EPSS

3.8%

Published

Jan 7, 2015

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in some VPN software lets attackers crash the service by sending one specially made network message.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.

Why it matters to the business

Disrupts availability of VPN services leading to operational downtime; low ecosystem prevalence but high urgency due to age and public knowledge.

How an attack unfolds

An attacker crafts an IKEv2 Key Exchange message specifying DH group 1025 and sends it to the vulnerable service, triggering an invalid pointer dereference that crashes the process.

How to fix it

Upgrade to a fixed version such as commit 0a24f92d081033576bfdd9d4bdec1a54501734c1 in affected products.

How to confirm the fix worked

Confirm deployment of the listed commit or later equivalent and test processing of DH group 1025 messages without crash.

Typical attack path

  1. Craft IKEv2 KE message with DH group 1025
  2. Transmit message to exposed service endpoint
  3. Trigger invalid pointer dereference resulting in denial of service

How to detect it

Review service logs for crashes during IKEv2 Key Exchange processing and inspect for references to invalid DH groups or pointer errors.

What your security team should do

  • Apply the specified commit fix without delay
  • Restrict IKEv2 exposure to trusted networks where possible
  • Monitor logs for related crashes or malformed KE messages

The record

strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 strongswan 0 5.2.1-5
Debian:12 strongswan 0 5.2.1-5
Debian:13 strongswan 0 5.2.1-5
Debian:14 strongswan 0 5.2.1-5
Debian:7 strongswan 0 4.5.2-1.5+deb7u6
SUSE:Linux Enterprise Desktop 12 strongswan 0 5.1.3-9.1
SUSE:Linux Enterprise Server 12 strongswan 0 5.1.3-9.2
SUSE:Linux Enterprise Server for SAP Applications 12 strongswan 0 5.1.3-9.2
Ubuntu:14.04:LTS strongswan 0 5.1.2-0ubuntu2.2
openSUSE:Tumbleweed strongswan 0 5.3.5-1.1

Related vulnerabilities