{
  "threat_severity" : "Moderate",
  "public_date" : "2018-05-22T00:00:00Z",
  "bugzilla" : {
    "description" : "strongswan: integer underflow leads to buffer overflow and denial of service in stroke_socket.c",
    "id" : "1581867",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1581867"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-190->CWE-119",
  "details" : [ "In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may lead to resource exhaustion and denial of service while reading from the socket.", "An integer underflow has been discovered in strongSwan VPN's charon server, which could lead to a buffer overflow and consequent crash. A local attacker, with enough privileges to access the Unix Domain Socket /var/run/charon.ctl, could use this vulnerability to crash the charon server." ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Will not fix",
    "package_name" : "strongimcv",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2018-5388\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-5388" ],
  "name" : "CVE-2018-5388",
  "mitigation" : {
    "value" : "On Red Hat Enterprise Linux 7 only root has access to /var/run/charon.ctl so you need to be already root to exploit the vulnerability.",
    "lang" : "en:us"
  },
  "csaw" : false
}