Softpedia >Linux >Linux Blog
Softpedia Homepage   

strongSwan Exploit Closed in Ubuntu 14.10 and Ubuntu 14.04 LTS

A problem has been corrected with a couple of Ubuntu OSes

Jan 5, 2015 14:54 GMT  ·  By
Ubuntu 14.10 with Unity
   Ubuntu 14.10 with Unity

Canonical revealed details about a strongSwan vulnerability its Ubuntu 14.10 and Ubuntu 14.04 LTS operating systems that has been found and corrected. It's not a major issue, but it's advisable to upgrade nonetheless.

strongSwan is an open source IPsec-based VPN solution also used by Ubuntu. Developers found that strongSwan could have been made to crash by flooding it with a special kind of network traffic.

"Mike Daskalakis discovered that strongSwan incorrectly handled IKEv2 payloads that contained the Diffie-Hellman group 1025. A remote attacker could use this issue to cause the IKE daemon to crash, resulting in a denial of service," reads the official security notice. For a more detailed description of the problems, you can see Canonical's security notification.

The flaws can be fixed if you upgrade your system(s) to the latest strongswan-ike package specific to each distribution. To apply the patch, run the Update Manager application or use the terminal. Just open a terminal and enter the following commands (root will be needed):

code
sudo apt-get update
sudo apt-get dist-upgrade
In general, a standard system update will make all the necessary changes. You won't have to restart the computer in order to complete the update. That is usually the case with kernel updates and a few other packages.