Bugzilla – Bug 931989
VUL-0: CVE-2015-4047: ipsec-tools: NULL pointer dereference in racoon/gssapi.c
Last modified: 2018-12-15 15:44:56 UTC
rh#1223419 / CVE-2015-4047 --------------------------------------------- A NULL pointer dereference flaw was found in IPsecTools. A remote attacker could use this flaw to crash the IKE daemon via specially crafted UDP packets if the HAVE_GSSAPI configuration option is set. CVE request: http://seclists.org/oss-sec/2015/q2/503 Proposed patch: http://seclists.org/fulldisclosure/2015/May/83 External References: https://www.altsci.com/ipsec/ipsec-tools-sa.html --------------------------------------------- References: https://bugzilla.redhat.com/show_bug.cgi?id=1223419 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4047 http://seclists.org/oss-sec/2015/q2/522 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4047
This is an autogenerated message for OBS integration: This bug (931989) was mentioned in https://build.opensuse.org/request/show/308401 13.2+13.1 / ipsec-tools
submitrequests created for os13.1, os13.2, SLE-11, SLE-11-SP1 and SLE-10-SP2
An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2015-06-09. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/61802
(In reply to Jiri Bohac from comment #4) > submitrequests created for os13.1, os13.2, SLE-11, SLE-11-SP1 and SLE-10-SP2 Build is failing for 13.1, please check: https://build.opensuse.org/request/show/308401
bugbot adjusting priority
(In reply to Andreas Stieger from comment #7) > (In reply to Jiri Bohac from comment #4) > > submitrequests created for os13.1, os13.2, SLE-11, SLE-11-SP1 and SLE-10-SP2 > > Build is failing for 13.1, please check: > https://build.opensuse.org/request/show/308401 This is not caused by the patch for this bug, but appears to be caused by an OpenSSL upgrade, containing this openssl commit: 3009244da47b989c4cc59ba02cf81a4e9d8f8431. The problem is described here: https://www.mail-archive.com/openssl-dev@openssl.org/msg35948.html I'm not sure what to do about it yet.
SUSE-SU-2015:1367-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 931989,939810 CVE References: CVE-2015-4047 Sources used: SUSE Linux Enterprise Server for VMWare 11-SP3 (src): ipsec-tools-0.7.3-1.13.1 SUSE Linux Enterprise Server 11-SP4 (src): ipsec-tools-0.7.3-1.13.1 SUSE Linux Enterprise Server 11-SP3 (src): ipsec-tools-0.7.3-1.13.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): ipsec-tools-0.7.3-1.13.1