CVE-2015-4171

What it actually does

The flaw allows a remote server presenting a valid certificate to complete IKEv2 authentication using EAP or pre-shared keys without enforcing server authentication restrictions until the full process finishes, after which the client responses containing credentials can be read by the server.

Why it matters to the business

Attackers can obtain VPN authentication credentials, enabling unauthorized network access and potential lateral movement or data exposure in environments relying on the affected VPN components.

How an attack unfolds

An attacker hosts a server that supplies a certificate accepted by the client, initiates an IKEv2 session, and captures credential material sent during the incomplete authentication exchange before restrictions are applied.

How to fix it

Upgrade crowbar/barclamp-trove to commit 932298f250365fed6963700870e52db3a7a32daa and crowbar/crowbar-openstack to commit 208230bdfbcb19d062149d083b1a66b429516a69; verify the updated packages are deployed across all affected systems and restart related services.

How to confirm the fix worked

Confirm package versions match the listed fixed commits, review strongSwan configuration for EAP and pre-shared key usage, and test that server authentication is enforced at the start of IKEv2 exchanges.

Typical attack path

1. Attacker provisions a server presenting a certificate chain accepted by the client implementation.
2. Victim client initiates an IKEv2 connection to the attacker's server using EAP or pre-shared key authentication.
3. Server participates in the exchange without full server authentication enforcement.
4. Client transmits credential responses that the server records before authentication completes.
5. Attacker uses captured credentials for subsequent unauthorized access.

How to detect it

Review VPN client logs for IKEv2 sessions with unexpected certificate subjects or servers, inspect authentication response artifacts, and correlate with network flows to untrusted endpoints during the vulnerable period.

What your security team should do

• Apply the specified commit upgrades immediately on all instances of the affected packages.
• Audit VPN connection logs for unexpected remote servers and credential exposure indicators.
• Enforce certificate pinning or additional server identity checks in client configurations where possible.
• Monitor for any downstream dependents that may inherit the vulnerable strongSwan behavior.