NVD Vulnerability Detail

CVE-2020-1763

Summary	An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.
Publication Date	May 12, 2020, 11:15 p.m.
Registration Date	Jan. 26, 2021, 11:54 a.m.
Last Update	Nov. 21, 2024, 2:11 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	https://bugzilla.redhat.com/show_bug.cgi?id=1813329	Issue Tracking Third Party Advisory
2	https://bugzilla.redhat.com/show_bug.cgi?id=1813329	Issue Tracking Third Party Advisory
3	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1763	Issue Tracking Third Party Advisory
4	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1763	Issue Tracking Third Party Advisory
5	https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf	Third Party Advisory
6	https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf	Third Party Advisory
7	https://github.com/libreswan/libreswan/commit/471a3e41a449d7c753bc4edbba4239501bb62ba8	Patch Third Party Advisory
8	https://github.com/libreswan/libreswan/commit/471a3e41a449d7c753bc4edbba4239501bb62ba8	Patch Third Party Advisory
9	https://libreswan.org/security/CVE-2020-1763/CVE-2020-1763.txt	Patch Vendor Advisory
10	https://libreswan.org/security/CVE-2020-1763/CVE-2020-1763.txt	Patch Vendor Advisory
11	https://security.gentoo.org/glsa/202007-21	Third Party Advisory
12	https://security.gentoo.org/glsa/202007-21	Third Party Advisory
13	https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04	Third Party Advisory US Government Resource
14	https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04	Third Party Advisory US Government Resource
15	https://www.debian.org/security/2020/dsa-4684	Third Party Advisory
16	https://www.debian.org/security/2020/dsa-4684	Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

libreswan における境界外読み取りに関する脆弱性

Title	libreswan における境界外読み取りに関する脆弱性
Summary	libreswan には、境界外読み取りに関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 19, 2020, midnight
Registration Date	June 11, 2020, 1:53 p.m.
Last Update	Feb. 17, 2021, 5:01 p.m.

Affected System

Libreswan Project

Libreswan 3.27 から 3.31

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-1763	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1763
Libreswan
2	CVE-2020-1763: Malicious IKEv1 packet can cause libreswan to restart	https://libreswan.org/security/CVE-2020-1763/CVE-2020-1763.txt
National Vulnerability Database (NVD)
3	CVE-2020-1763	https://nvd.nist.gov/vuln/detail/CVE-2020-1763

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-125	https://cwe.mitre.org/data/definitions/125.html

ベンダー情報

No	Name	URL
GitHub
1	security: Fix for CVE-2020-1763	https://github.com/libreswan/libreswan/commit/471a3e41a449d7c753bc4edbba4239501bb62ba8

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-21-040-04	https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04
JVN
2	JVNVU#91083521	https://jvn.jp/vu/JVNVU91083521/

Change Log

No	Changed Details	Date of change
2	[2021年02月15日] 参考情報：JVN (JVNVU#91083521) を追加	Feb. 15, 2021, 5:26 p.m.
1	[2020年06月11日] 掲載	June 11, 2020, 1:53 p.m.
3	[2021年02月17日] 参考情報：ICS-CERT ADVISORY (ICSA-21-040-04) を追加	Feb. 17, 2021, 4:29 p.m.