4.9
CVSSv2

CVE-2013-2944

Published: 02/05/2013 Updated: 07/11/2023
CVSS v2 Base Score: 4.9 | Impact Score: 4.9 | Exploitability Score: 6.8
VMScore: 436
Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N

Vulnerability Summary

strongSwan 4.3.5 up to and including 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote malicious users to authenticate as other users via an invalid signature.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

strongswan strongswan 4.3.7

strongswan strongswan 4.5.3

strongswan strongswan 4.5.2

strongswan strongswan 5.0.1

strongswan strongswan 4.4.0

strongswan strongswan 4.5.1

strongswan strongswan 4.3.5

strongswan strongswan 4.6.4

strongswan strongswan 4.6.2

strongswan strongswan 4.6.1

strongswan strongswan 5.0.2

strongswan strongswan 4.3.6

strongswan strongswan 4.6.0

strongswan strongswan 4.6.3

strongswan strongswan 5.0.0

strongswan strongswan 4.4.1

strongswan strongswan 4.5.0

Vendor Advisories

Kevin Wojtysiak discovered a vulnerability in strongSwan, an IPsec based VPN solution When using the OpenSSL plugin for ECDSA based authentication, an empty, zeroed or otherwise invalid signature is handled as a legitimate one An attacker could use a forged signature to authenticate like a legitimate user and gain access to the VPN (and everythin ...