CVE-2013-6075

Published: Nov 2, 2013Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The compare_dn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows (1) remote attackers to cause a denial of service (out-of-bounds read, NULL pointer dereference, and daemon crash) or (2) remote authenticated users to impersonate arbitrary users and bypass access restrictions via a crafted ID_DER_ASN1_DN ID, related to an "insufficient length check" during identity comparison.

Affected (22)

Products: Strongswan: Strongswan

Strongswan

1 product

Strongswan

Configuration A

22 vulnerable

Vulnerable Software	Affected Versions
Strongswan Strongswan	Version 4.3.3
Strongswan Strongswan	Version 4.3.4
Strongswan Strongswan	Version 4.3.5
Strongswan Strongswan	Version 4.3.6
Strongswan Strongswan	Version 4.3.7
Strongswan Strongswan	Version 4.4.0
Strongswan Strongswan	Version 4.4.1
Strongswan Strongswan	Version 4.5.0
Strongswan Strongswan	Version 4.5.1
Strongswan Strongswan	Version 4.5.2
Strongswan Strongswan	Version 4.5.3
Strongswan Strongswan	Version 4.6.0
Strongswan Strongswan	Version 4.6.1
Strongswan Strongswan	Version 4.6.2
Strongswan Strongswan	Version 4.6.3
Strongswan Strongswan	Version 4.6.4
Strongswan Strongswan	Version 5.0.0
Strongswan Strongswan	Version 5.0.1
Strongswan Strongswan	Version 5.0.2
Strongswan Strongswan	Version 5.0.3
Strongswan Strongswan	Version 5.0.4
Strongswan Strongswan	Version 5.1.0