diff -Nru strongswan-5.1.2/debian/changelog strongswan-5.1.2/debian/changelog --- strongswan-5.1.2/debian/changelog 2014-03-01 08:53:50.000000000 +0000 +++ strongswan-5.1.2/debian/changelog 2014-04-14 15:26:06.000000000 +0000 @@ -1,3 +1,12 @@ +strongswan (5.1.2-0ubuntu2) trusty; urgency=medium + + * SECURITY UPDATE: remote authentication bypass + - debian/patches/CVE-2014-2338.patch: reject CREATE_CHILD_SA exchange + on unestablished IKE_SAs in src/libcharon/sa/ikev2/task_manager_v2.c. + - CVE-2014-2338 + + -- Marc Deslauriers Mon, 14 Apr 2014 11:24:34 -0400 + strongswan (5.1.2-0ubuntu1) trusty; urgency=low * New upstream release. diff -Nru strongswan-5.1.2/debian/control strongswan-5.1.2/debian/control --- strongswan-5.1.2/debian/control 2014-03-01 08:53:13.000000000 +0000 +++ strongswan-5.1.2/debian/control 2014-04-14 15:26:25.000000000 +0000 @@ -1,7 +1,8 @@ Source: strongswan Section: net Priority: optional -Maintainer: strongSwan Maintainers +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: strongSwan Maintainers Uploaders: Rene Mayrhofer , Yves-Alexis Perez Standards-Version: 3.9.5 diff -Nru strongswan-5.1.2/debian/patches/CVE-2014-2338.patch strongswan-5.1.2/debian/patches/CVE-2014-2338.patch --- strongswan-5.1.2/debian/patches/CVE-2014-2338.patch 1970-01-01 00:00:00.000000000 +0000 +++ strongswan-5.1.2/debian/patches/CVE-2014-2338.patch 2014-04-14 15:24:30.000000000 +0000 @@ -0,0 +1,36 @@ +From b980ba7757dcfedd756aa055b3271ea58cf85aa6 Mon Sep 17 00:00:00 2001 +From: Martin Willi +Date: Thu, 20 Feb 2014 16:08:43 +0100 +Subject: [PATCH] ikev2: Reject CREATE_CHILD_SA exchange on unestablished + IKE_SAs + +Prevents a responder peer to trick us into established state by starting +IKE_SA rekeying before the IKE_SA has been authenticated during IKE_AUTH. + +Fixes CVE-2014-2338 for 5.x versions of strongSwan. +--- + src/libcharon/sa/ikev2/task_manager_v2.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c +index ac3be90..a5252ab 100644 +--- a/src/libcharon/sa/ikev2/task_manager_v2.c ++++ b/src/libcharon/sa/ikev2/task_manager_v2.c +@@ -778,6 +778,15 @@ static status_t process_request(private_task_manager_t *this, + case CREATE_CHILD_SA: + { /* FIXME: we should prevent this on mediation connections */ + bool notify_found = FALSE, ts_found = FALSE; ++ ++ if (this->ike_sa->get_state(this->ike_sa) == IKE_CREATED || ++ this->ike_sa->get_state(this->ike_sa) == IKE_CONNECTING) ++ { ++ DBG1(DBG_IKE, "received CREATE_CHILD_SA request for " ++ "unestablished IKE_SA, rejected"); ++ return FAILED; ++ } ++ + enumerator = message->create_payload_enumerator(message); + while (enumerator->enumerate(enumerator, &payload)) + { +-- +1.8.1.2 diff -Nru strongswan-5.1.2/debian/patches/series strongswan-5.1.2/debian/patches/series --- strongswan-5.1.2/debian/patches/series 2014-03-01 08:53:13.000000000 +0000 +++ strongswan-5.1.2/debian/patches/series 2014-04-14 15:24:30.000000000 +0000 @@ -1 +1,2 @@ 01_fix-manpages.patch +CVE-2014-2338.patch