[security-announce] IPSec-tools: Security Update

Sona Sarmadi sona.sarmadi at enea.com
Fri Nov 27 08:31:30 CET 2015


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

	Enea Linux Security Advisory

=========================================================
Product/package: IPSec-tools 0.8.2
Severity: Moderate
CVE Names: CVE-2015-4047
Layer: poky/meta-openembedded
=========================================================

This security update fixes a NULL pointer dereference in
racoon/gssapi.c in ipsec-tools.


Description
===========
racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers
to cause a denial of service (NULL pointer dereference and IKE
daemoncrash) via a series of crafted UDP requests.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-4047
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4047
http://seclists.org/oss-sec/2015/q2/503


Proposed patch:
http://seclists.org/fulldisclosure/2015/May/83


Correction for Enea Linux 5.0:
http://git.enea.com/cgit/linux/meta-openembedded.git/commit/?h=dizzy&id=
2bcc373d5a9979c965e7350b8572ff257852b6d9


How to get the latest patches
=============================
- - If you have already cloned meta-enea, update it to get new
security patches.

cd Enea-Linux-5.0/poky/meta-openembedded
git pull

- - If you have not yet cloned needed repositories, do it as described
below. (All patches are fetched implicitly when cloning the repos).

mkdir Enea-Linux-5.0
git -C Enea-Linux-5.0 clone -b dizzy git://git.enea.com/linux/poky.git
POKY=Enea-Linux-5.0/poky git -C $POKY clone -b dizzy
git://git.enea.com/linux/meta-enea.git;
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-
hierofalcon.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-linaro.git
git -C $POKY clone -b dizzy git://git.enea.com/linux/meta-
openembedded.git
git -C $POKY clone -b dizzy
git://git.enea.com/linux/meta-virtualization.git
git -C $POKY/meta-enea clone -b dizzy git://git.enea.com/linux/meta-
vt.git


If you have any questions regarding the security patches and security
updates please contact security at enea.com.


Enea Security Team
Sona Sarmadi
Mobile: +46 70 971 4475
www.enea.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJWWAbSAAoJEHc+9u9ocWoUtVgP/j77ZyOfNBBn5zGCf9+Nyo/h
GED/brGqq5uinAqw7wVRY33bql3ZzJDckSNzrm2941k9zMzg+7xiPCPOGV29KzpD
2CbkFvg3jNCn+O2cRCwg2O5TKIzWjj1Kby+sRqwdDcZoDQ9H6SaI/1Df4iOQcIWv
mBeI5CMdsVosOCpMaJcxsAPTYbREx2j6EIN5mqlFuufHjDb8AKiyHpzEjZteR8Vp
ikksiVqW6pABhYQj7SQVRhm7stoDrod4HIiNDvNdZpkxVzsw+6vLwJXelbgMfxyP
55g1V4zcXrK1XsDPH0pwbHuwetwW33gE8kv+GeNccbWo2fUjWF+OlsYWIa6AilwE
1orgsXcGJUXpbi6dicc9u0hjTeYlX8OZgxLCVXYsihm0I4BnXJLUZKVgiY9Ya+t8
oeaUuJ5vIBN0HVTlhL5vDYbWzLCVCBNe0qTxNY+GCm4iQ4AaQiwdZJX+wMVqy03D
bD9r3IKY+pa6wKC+gjj8Ep0coBQpCj87HZm4ONcRYbiQr63yOqXauhMgmJKQR1fO
RjQvQ5IeYhm/6ulNaHsdlmp9qd94lKhKoveRrcz9R8IMInVR1Bw4MHz9Kvg/hhOY
EI/OXCiaDlDc08LizZJLClYJHqpiUxgU/xnDyaHz6YyH8Vf6299mXnmlohZOH8Qb
1HZwTocwotAAqrHZYQ4j
=iQH0
-----END PGP SIGNATURE-----



More information about the security-announce mailing list