[ GLSA 201203-13 ] Openswan: Denial of Service

[GLSA]

Gentoo Linux Security Advisory

Title: Openswan: Denial of Service (GLSA 201203-13)
Severity: normal
Exploitable: local, remote
Date: March 16, 2012
Bug(s): #372961, #389097
ID: 201203-13

Synopsis

Multiple vulnerabilities in Openswan may create a Denial of Service
condition.


Background

Openswan is an implementation of IPsec for Linux.

Affected Packages

Package: net-misc/openswan
Vulnerable: < 2.6.37
Unaffected: >= 2.6.37
Architectures: All supported architectures


Description

Two vulnerabilities have been found in Openswan:

• Improper permissions are used on /var/run/starter.pid and
  /var/lock/subsys/ipsec (CVE-2011-2147).
  
• Openswan contains a use-after-free error in the cryptographic helper
  handler (CVE-2011-4073).
  

Impact

A remote authenticated attacker or a local attacker may be able to cause
a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All Openswan users should upgrade to the latest version: