RHBA-2014:0519 - Bug Fix Advisory

Topic

Updated openswan packages that fix several bugs are now available for Red Hat
Enterprise Linux 6.

Description

Openswan is a free implementation of Internet Protocol Security (IPsec) and
Internet Key Exchange (IKE). IPsec uses strong cryptography to provide both
authentication and encryption services. These services allow you to build secure
tunnels through untrusted networks.

This update fixes the following bugs:

• Prior to this update, rebooting some IPsec gateways did not properly remove

the routing table entries for the secure tunnel. As a consequence, when the
IPsec gateway reestablished the tunnel, traffic was not properly routed over the
tunnel. This update fixes the code that manages routing table entries. As a
result, the traffic is now routed properly in the described scenario.
(BZ#1089395)

• Previously, an update to the openswan packages omitted support for

NAT-Traversal (NAT-T) as specified in the IETF drafts (predating RFC 3947). As a
consequence, devices that do not support RFC 3947 were no longer able to connect
to openswan using IKE. With this update, support for NAT-Traversal draft
(non-RFC) has been reintroduced into the openswan packages. As a result, the
described devices are able to connect to openswan. (BZ#1090273)

• Prior to this update, when openswan was run as root it dropped privileges as

part of its operation. As a consequence, openswan was unable to read
configuration files located in directories not owned by root. With this update,
these privileges are no longer dropped when openswan is run as root and will
need to access configuration files in a directory not owned by root. As a
result, openswan successfully reads configuration files as expected.
(BZ#1090614)

• Previously, when Openswan was stopped or restarted, the openswan scripts

(called by the ipsec initscript) logged a harmless error message which had no
impact on functionality. The message read that Openswan is not being able to
unload the IPsec kernel modules. With this update, initscripts no longer attempt
to unload the IPsec kernel modules once loaded, and error messages are no longer
returned. (BZ#1096640)

Users of openswan are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.5 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.5 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.5 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - AUS 6.5 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - TUS 6.5 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.5 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.5 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 1090273 - openswan breaks NAT-T draft clients (and possibly ike fragmentation)
• BZ - 1090614 - Due to lack of CAP_DAC_OVERRIDE, pluto cannot write to directories not owned by root

CVEs

(none)

References

(none)