{"id":111715,"date":"2023-11-23T15:10:28","date_gmt":"2023-11-23T13:10:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-strongswan-ipsec-privodyashhaya-k-udalyonnomu-vypolneniyu-koda"},"modified":"2023-11-23T15:10:28","modified_gmt":"2023-11-23T13:10:28","slug":"uyazvimost-v-strongswan-ipsec-privodyashhaya-k-udalyonnomu-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-strongswan-ipsec-privodyashhaya-k-udalyonnomu-vypolneniyu-koda","title":{"rendered":"Sebezhet\u0151s\u00e9g a strongSwan IPsec-ben, amely t\u00e1voli k\u00f3dfuttat\u00e1shoz vezethet.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A strongSwan, az IPSec protokollal k\u00e9sz\u00fclt VPN-csomagban, amely Linux, Android, FreeBSD \u00e9s macOS rendszerekben haszn\u00e1latos, s\u00e9r\u00fcl\u00e9kenys\u00e9get (CVE-2023-41913) fedeztek fel, amelyet a t\u00e1mad\u00f3 t\u00e1voli k\u00f3dv\u00e9grehajt\u00e1s\u00e1ra lehet kihaszn\u00e1lni. A s\u00e9r\u00fcl\u00e9kenys\u00e9g a charon-tkm folyamat\u00e1ban l\u00e9v\u0151 hib\u00e1b\u00f3l ered, amely a TKMv2 (Trusted Key Manager) alap\u00fa kulcscser\u00e9l\u00e9si protokollt val\u00f3s\u00edtja meg, \u00e9s amely a DH (Diffie\u2013Hellman) s\u00e9ma speci\u00e1lisan kialak\u00edtott \u00e9rt\u00e9keinek feldolgoz\u00e1sa k\u00f6zben puffer t\u00falcsordul\u00e1shoz vezet. A s\u00e9r\u00fcl\u00e9kenys\u00e9g csak azokat a rendszereket \u00e9rinti, amelyek charon-tkm-et haszn\u00e1lnak, \u00e9s a strongSwan kiad\u00e1sait, amelyek 5.3.0 verzi\u00f3t\u00f3l kezd\u0151dnek. A probl\u00e9m\u00e1t a strongSwan 5.9.12 friss\u00edt\u00e9s\u00e9ben orvosolt\u00e1k. Az 5.3.x vonalat\u00f3l kezd\u0151d\u0151 verzi\u00f3khoz szint\u00e9n k\u00e9sz\u00fclt patch a s\u00e9r\u00fcl\u00e9kenys\u00e9g jav\u00edt\u00e1s\u00e1ra. <\/p>\n

The error is caused by the lack of size checks for the public Diffie-Hellman values before copying them into a fixed-size buffer in the stack. The overflow can be triggered by sending a specially crafted IKE_SA_INIT message, processed without authentication. In older versions of strongSwan, size checks were performed in the KE payload (Key Exchange) handler, but in version 5.3.0, changes were made to move the size check for public values to the DH protocol handler, adding standard functions to simplify the validation of known DH groups. By oversight, the new validation functions were omitted from the charon-tkm process, which acts as a proxy between the IKE process and the TKM (Trusted Key Manager), causing unchecked values to reach the memcpy() function, allowing up to 10,000 bytes of data to be written to a 512-byte buffer.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 strongSwan, VPN-\u043f\u0430\u043a\u0435\u0442\u0435 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPSec, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Linux, Android, FreeBSD \u0438 macOS, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-41913), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 charon-tkm \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u043b\u044e\u0447\u0430\u043c\u0438 (IKE) \u043d\u0430 \u0431\u0430\u0437\u0435 TKMv2 (Trusted Key Manager), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0439 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0441\u0445\u0435\u043c\u044b DH (Diffie–Hellman). […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111715","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerability in strongSwan IPsec leading to remote code execution | ProHoster","description":"A strongSwan, VPN package based on the IPSec protocol, used in Linux, Android, FreeBSD, and macOS, has a vulnerability (CVE-2023-41913) that can be exploited for remote code execution by attackers.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-strongswan-ipsec-privodyashhaya-k-udalyonnomu-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 strongSwan IPsec, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 strongSwan, VPN-\u043f\u0430\u043a\u0435\u0442\u0435 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPSec, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 Linux, Android, FreeBSD \u0438 macOS, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-41913), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-strongswan-ipsec-privodyashhaya-k-udalyonnomu-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-23T13:10:28+00:00","article:modified_time":"2023-11-23T13:10:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/111715","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=111715"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/111715\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=111715"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=111715"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=111715"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}