CVE-2015-3240

Published: Nov 9, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of service (assertion failure and daemon restart) via a zero DH g^x value in a KE payload in a IKE packet.

Affected (1)

Products: Libreswan: Libreswan

Libreswan

1 product

Libreswan

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libreswan Libreswan	Version 3.14

Related CWEs

CWE-189

References (14)

http://rhn.redhat.com/errata/RHSA-2015-1979.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/77536

Source: secalert@redhat.com

http://www.securitytracker.com/id/1033418

Source: secalert@redhat.com

https://libreswan.org/security/CVE-2015-3240/CVE-2015-3240.txt

Source: secalert@redhat.com

Vendor Advisory

https://lists.openswan.org/pipermail/users/2015-August/023401.html

Source: secalert@redhat.com

Vendor Advisory

https://security.gentoo.org/glsa/201603-13

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2015-1979.html