USN-2811-1: strongSwan vulnerability

Publication date

16 November 2015

Overview

strongSwan could be made to bypass authentication.

Releases

Packages

It was discovered that the strongSwan eap-mschapv2 plugin incorrectly
handled state. A remote attacker could use this issue to bypass
authentication.

In general, a standard system update will make all the necessary changes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
15.10 wily	strongswan-plugin-eap-mschapv2 – 5.1.2-0ubuntu6.2
15.04 vivid	strongswan-plugin-eap-mschapv2 – 5.1.2-0ubuntu5.3
14.04 trusty	strongswan-plugin-eap-mschapv2 – 5.1.2-0ubuntu2.4

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro