Udgivelsen af strongSwan 5.9.10 er tilg\u00e6ngelig, et gratis v\u00e6rkt\u00f8j til oprettelse af VPN-forbindelser baseret p\u00e5 IPSec-protokollen, der anvendes i Linux, Android, FreeBSD og macOS. I den nye version er en alvorlig s\u00e5rbarhed (CVE-2023-26463) blevet rettet, som kan udnyttes til at omg\u00e5 godkendelse, men som potentielt ogs\u00e5 kan f\u00f8re til, at en angrebskode k\u00f8res p\u00e5 serveren eller klienten. Problemet opst\u00e5r ved kontrol af specielt formaterede certifikater i godkendelsesmetoderne EAP (Extensible Authentication Protocol) baseret p\u00e5 TLS. <\/p>\n
S\u00e5rbarheden skyldes, at TLS-h\u00e5ndtereren forkert accepterer \u00e5bne n\u00f8gler fra naboens certifikat som betroede, selvom certifikatet ikke kan verificeres med succes. Specifikt anvendes ved kald til funktionen tls_find_public_key() en udv\u00e6lgelse baseret p\u00e5 typen af den \u00e5bne n\u00f8gle for at bestemme de betroede certifikater. Problemet er, at den variabel, der bruges til at bestemme typen af n\u00f8gle til s\u00f8geoperationen, alligevel s\u00e6ttes, selvom certifikatet ikke er betroet. <\/p>\n
Desuden kan man ved manipulation med n\u00f8glen opn\u00e5 en reduktion af reference t\u00e6lleren (hvis certifikatet ikke er betroet, frigives objektreferencen efter bestemmelsen af n\u00f8gletypen) og frigive hukommelse til et endnu anvendt objekt med n\u00f8glen. Den n\u00e6vnte fejl udelukker ikke muligheden for at skabe exploits til at organisere l\u00e6kage af oplysninger fra hukommelsen og udf\u00f8re sin egen kode. <\/p>\n
Angrebet p\u00e5 server<\/a> foreg\u00e5r ved, at klienten sender et selvsigneret certifikat til klientgodkendelse ved hj\u00e6lp af metoderne EAP-TLS, EAP-TTLS, EAP-PEAP og EAP-TNC. Et angreb p\u00e5 klienten kan udf\u00f8res ved at returnere serveren<\/a> et s\u00e6rligt formateret certifikat. S\u00e5rbarheden er til stede i versionerne strongSwan 5.9.8 og 5.9.9. Opdateringer af pakker i distributionerne kan f\u00f8lges p\u00e5 siderne: Debian, Ubuntu, Gentoo, RHEL, SUSE, Arch, FreeBSD, NetBSD. \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a strongSwan 5.9.10, \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f VPN-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPSec, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 Linux, Android, FreeBSD \u0438 macOS. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-26463), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043d\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438\u043b\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107077","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i strongSwan IPsec, der tillader fjernudf\u00f8relse af kode | ProHoster","description":"Udgivelsen af strongSwan 5.9.10 er tilg\u00e6ngelig, et gratis v\u00e6rkt\u00f8j til oprettelse af VPN-forbindelser baseret p\u00e5 IPSec-protokollen, der anvendes i Linux, Android, FreeBSD og macOS.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-strongswan-ipsec-dopuskayushhaya-udalyonnoe-vypolnenie-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 strongSwan IPsec, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a strongSwan 5.9.10, \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f VPN-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPSec, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 Linux, Android, FreeBSD \u0438 macOS.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-strongswan-ipsec-dopuskayushhaya-udalyonnoe-vypolnenie-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-03T10:48:24+00:00","article:modified_time":"2023-03-05T09:49:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"107077","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:46:34","updated":"2026-02-09 21:46:34","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/107077","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=107077"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/107077\/revisions"}],"predecessor-version":[{"id":172813,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/107077\/revisions\/172813"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=107077"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=107077"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=107077"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"