Test ID:	1.3.6.1.4.1.25623.1.1.2.2021.1364
Category:	Huawei EulerOS Local Security Checks
Title:	Huawei EulerOS: Security Advisory for strongimcv (EulerOS-SA-2021-1364)
Summary:	The remote host is missing an update for the Huawei EulerOS 'strongimcv' package(s) announced via the EulerOS-SA-2021-1364 advisory.
Description:	Summary: The remote host is missing an update for the Huawei EulerOS 'strongimcv' package(s) announced via the EulerOS-SA-2021-1364 advisory. Vulnerability Insight: The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate.(CVE-2018-17540) In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data in the digestAlgorithm.parameters field during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication. This is a variant of CVE-2006-4790 and CVE-2014-1568.(CVE-2018-16152) In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data after the encoded algorithm OID during PKCS#1 v1.5 signature verification. Similar to the flaw in the same version of strongSwan regarding digestAlgorithm.parameters, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation when only an RSA signature is used for IKEv2 authentication.(CVE-2018-16151) strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable.(CVE-2018-10811) The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating point exception and process crash) via a crafted certificate.(CVE-2017-9022) The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature.(CVE-2017-11185) The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in strongSwan 4.2.12 through 5.x before 5.3.4 does not properly validate local state, which allows remote attackers to bypass authentication via an empty Success message in response to an initial Challenge message.(CVE-2015-8023) strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.(CVE-2015-4171) Affected Software/OS: 'strongimcv' package(s) on Huawei EulerOS V2.0SP2. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-4171 BugTraq ID: 74933 http://www.securityfocus.com/bid/74933 Debian Security Information: DSA-3282 (Google Search) http://www.debian.org/security/2015/dsa-3282 http://www.openwall.com/lists/oss-security/2015/05/29/7 http://www.openwall.com/lists/oss-security/2015/05/29/6 http://www.openwall.com/lists/oss-security/2015/06/08/4 http://www.securitytracker.com/id/1032514 SuSE Security Announcement: openSUSE-SU-2015:1082 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-06/msg00040.html http://www.ubuntu.com/usn/USN-2628-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-8023 BugTraq ID: 84947 http://www.securityfocus.com/bid/84947 Debian Security Information: DSA-3398 (Google Search) http://www.debian.org/security/2015/dsa-3398 SuSE Security Announcement: SUSE-SU-2015:2183 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00025.html SuSE Security Announcement: openSUSE-SU-2015:2103 (Google Search) http://lists.opensuse.org/opensuse-updates/2015-11/msg00139.html http://www.ubuntu.com/usn/USN-2811-1 Common Vulnerability Exposure (CVE) ID: CVE-2017-11185 BugTraq ID: 100492 http://www.securityfocus.com/bid/100492 Debian Security Information: DSA-3962 (Google Search) http://www.debian.org/security/2017/dsa-3962 Common Vulnerability Exposure (CVE) ID: CVE-2017-9022 BugTraq ID: 98760 http://www.securityfocus.com/bid/98760 Debian Security Information: DSA-3866 (Google Search) http://www.debian.org/security/2017/dsa-3866 http://www.ubuntu.com/usn/USN-3301-1 Common Vulnerability Exposure (CVE) ID: CVE-2018-10811 Debian Security Information: DSA-4229 (Google Search) https://www.debian.org/security/2018/dsa-4229 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBO6ZQKLB5RY3TV7MXADFTQKXA2LUEIL/ https://security.gentoo.org/glsa/201811-16 SuSE Security Announcement: openSUSE-SU-2019:2594 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00077.html SuSE Security Announcement: openSUSE-SU-2019:2598 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00001.html SuSE Security Announcement: openSUSE-SU-2020:0403 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00047.html https://usn.ubuntu.com/3771-1/ Common Vulnerability Exposure (CVE) ID: CVE-2018-16151 Debian Security Information: DSA-4305 (Google Search) https://www.debian.org/security/2018/dsa-4305 https://lists.debian.org/debian-lts-announce/2018/09/msg00032.html Common Vulnerability Exposure (CVE) ID: CVE-2018-16152 Common Vulnerability Exposure (CVE) ID: CVE-2018-17540 Debian Security Information: DSA-4309 (Google Search) https://www.debian.org/security/2018/dsa-4309 https://lists.debian.org/debian-lts-announce/2018/10/msg00001.html https://usn.ubuntu.com/3774-1/
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.