CVE Feed

    Dashboard / CVE / CVE-2013-5018

    CVE-2013-5018

    The is_asn1 function in strongSwan 4.1.11 through 5.0.4 does not properly validate the return value of the asn1_length function, which allows remote attackers to cause a denial of service (segmentation fault) via a (1) XAuth username, (2) EAP identity, or (3) PEM encoded file that starts with a 0x04, 0x30, or 0x31 character followed by an ASN.1 length value that triggers an integer overflow.

    Published:Aug 1, 2013
    Last Modified:Apr 11, 2025
    EPS:Aug 28, 2013
    EPSS Score:0.02902
    CVSS Score:4.3

    Affected Products

    Vendor
    Opensuse
    Product
    Opensuse
    Vendor
    Strongswan
    Product
    Strongswan

    Exploits

    https://lists.strongswan.org/pipermail/users/2013-July/009540.htmlhttps://lists.strongswan.org/pipermail/users/2013-July/009540.html

    Related CVEs

    CVE-2020-4675 (CVSS 6.5) — IBM InfoSphere Master Data Management Server 11.6 is vulnerable to cross-site request forgery which could allo…
    CVE-2013-2637 (CVSS 6.1) — A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior …
    CVE-2013-3565 (CVSS 6.1) — Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before …
    CVE-2015-5333 (CVSS 7.5) — Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of …
    CVE-2015-5334 (CVSS 9.8) — Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denia…
    CVE-2014-3495 (CVSS 7.5) — duplicity 0.6.24 has improper verification of SSL certificates…
    CVE-2014-2387 (CVSS 4.4) — Pen 0.18.0 has Insecure Temporary File Creation vulnerabilities…
    CVE-2013-2625 (CVSS 6.5) — An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.…
    CVE-2011-1588 (CVSS 7.8) — Thunar before 1.3.1 could crash when copy and pasting a file name with % format characters due to a format str…
    CVE-2013-6365 (CVSS 5.3) — Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions…

    References

    http://lists.opensuse.org/opensuse-updates/2013-08/msg00021.html
    http://lists.opensuse.org/opensuse-updates/2013-08/msg00022.html
    http://lists.opensuse.org/opensuse-updates/2013-08/msg00050.html
    http://secunia.com/advisories/54315
    http://secunia.com/advisories/54524
    http://strongswan.org/blog/2013/08/01/strongswan-5.1.0-released.html
    http://strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html
    http://www.securityfocus.com/bid/61564
    https://lists.strongswan.org/pipermail/users/2013-July/009540.html
    http://lists.opensuse.org/opensuse-updates/2013-08/msg00021.html
    http://lists.opensuse.org/opensuse-updates/2013-08/msg00022.html
    http://lists.opensuse.org/opensuse-updates/2013-08/msg00050.html
    http://secunia.com/advisories/54315
    http://secunia.com/advisories/54524
    http://strongswan.org/blog/2013/08/01/strongswan-5.1.0-released.html
    http://strongswan.org/blog/2013/08/01/strongswan-denial-of-service-vulnerability-%28cve-2013-5018%29.html
    http://www.securityfocus.com/bid/61564
    https://lists.strongswan.org/pipermail/users/2013-July/009540.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High