Security update for strongswan SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:1791-1 Final 1 1 2015-10-14T08:51:39Z current 2015-10-14T08:51:39Z 2015-10-14T08:51:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for strongswan strongswan was updated to fix one security issue. This security issue was fixed: - CVE-2015-4171: A problem that could enable rogue servers to gain user credentials from a client in certain IKEv2 setups. (bsc#933591) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp4-strongswan-12152 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20151791-1/ Link for SUSE-SU-2015:1791-1 https://lists.suse.com/pipermail/sle-security-updates/2015-October/001641.html E-Mail link for SUSE-SU-2015:1791-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/933591 SUSE Bug 933591 https://www.suse.com/security/cve/CVE-2015-4171/ SUSE CVE CVE-2015-4171 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 strongswan-4.4.0-6.29.2 strongswan-doc-4.4.0-6.29.2 strongswan-4.4.0-6.29.2 as a component of SUSE Linux Enterprise Server 11 SP4 strongswan-doc-4.4.0-6.29.2 as a component of SUSE Linux Enterprise Server 11 SP4 strongswan-4.4.0-6.29.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 strongswan-doc-4.4.0-6.29.2 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses. CVE-2015-4171 SUSE Linux Enterprise Server 11 SP4:strongswan-4.4.0-6.29.2 SUSE Linux Enterprise Server 11 SP4:strongswan-doc-4.4.0-6.29.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:strongswan-4.4.0-6.29.2 SUSE Linux Enterprise Server for SAP Applications 11 SP4:strongswan-doc-4.4.0-6.29.2 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20151791-1/ https://www.suse.com/security/cve/CVE-2015-4171.html CVE-2015-4171 https://bugzilla.suse.com/931845 SUSE Bug 931845 https://bugzilla.suse.com/933591 SUSE Bug 933591