CVE-2017-11185 Null dereference in n/a
Remote attackers can crash the strongSwan daemon via a crafted RSA signature, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-11185?
CVE-2017-11185 is a high-severity vulnerability in n/a, published on 18 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature.
Weakness: CWE-476
Which versions are affected by CVE-2017-11185?
It affects 1 product.
Linux distribution packages (9)
strongswan SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 5.1.3-26.5.1 |
strongswan SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 5.1.3-26.5.1 |
strongswan SUSE:Linux Enterprise Server 11 SP4 | All versions | 4.4.0-6.36.3.1 |
strongswan SUSE:Linux Enterprise Server 12 SP2 | All versions | 5.1.3-26.5.1 |
strongswan SUSE:Linux Enterprise Server 12 SP3 | All versions | 5.1.3-26.5.1 |
strongswan SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 5.1.3-26.5.1 |
strongswan SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 4.4.0-6.36.3.1 |
strongswan SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 5.1.3-26.5.1 |
strongswan SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 5.1.3-26.5.1 |
Products include Strongswan Strongswan.
How do I fix CVE-2017-11185?
Upgrade to a fixed version.
Is CVE-2017-11185 being exploited?
There is no known exploitation of CVE-2017-11185 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as ALPINE-CVE-2017-11185, DEBIAN-CVE-2017-11185, DLA-1059-1, DSA-3962-1, GHSA-6hcq-7fxg-hvvv, SUSE-SU-2017:2143-1 and 3 more.